Release Update 19.32

This page describes the features and behavioral changes that are new in Release Update 19.32.

BFILENAME Queries Excluded from the Database Result Cache

SQL statements that contain the BFILENAME function are no longer cached in the Database Result Cache or display Result Cache information in their execution plans.

This change keeps execution plans accurate and prevents unsupported caching behavior for queries that reference external files, improving predictability and operational confidence.

Correct Audit Object Association for VPD/RLS-protected Objects

Audit records for access to objects protected by Oracle Virtual Private Database (VPD) or Fine-Grained Auditing (FGA) are now associated with the correct object.

Audit records and object-level policy evaluation remain accurate for queries protected by Oracle Virtual Private Database. This improvement helps administrators maintain accurate audit traceability and supports compliance reporting.

Database Replay Writes Diagnostic Messages to Trace Files

Database Replay operations now write diagnostic messages to trace files instead of the alert log.

This change reduces the number of alert log messages generated by Database Replay operations. It helps database administrators keep alert logs focused on database events while preserving diagnostic information in trace files.

DBMS_REDEFINITION Enforcement of Database Vault Authorization

DBMS_REDEFINITION now enforces Database Vault checks before table redefinition operations proceed. When Database Vault is enabled, the user invoking table redefinition must now be authorized to access both the original table and any interim table used during the redefinition process. This change applies to the following entry points in DBMS_REDEFINITION:

The update checks Database Vault Realm, Command Rule, and Ops Control protections before allowing data movement between tables. If the user is not authorized under Database Vault, the operation is blocked and an appropriate error is returned. It prevents unauthorized use of table redefinition to move data out of Database Vault-protected tables or to alter protected table metadata without Database Vault authorization.

Expanded Default Password Detection in DBA_USERS_WITH_DEFPWD

Supported DBA_USERS_WITH_DEFPWD queries now return additional default password account findings and associated product labels for SYS, SYSTEM, and ADMIN account combinations.

This feature gives administrators a more complete view of default password risks and the related product context for remediation.

Next-Generation Cryptographic Provider Announcement

Oracle Database 19c now supports a next-generation cryptographic provider based on OpenSSL (next-generation provider), in addition to the existing Dell BSAFE Crypto-C Micro Edition Suite, or MES (legacy provider).

This dual-provider architecture enables the following capabilities:

The legacy provider remains the default. To switch to the next-generation provider, run the set_crypto_provider.py script and restart the database instance and Oracle Net listener. Only one cryptographic provider can be active at a time.

View Documentation

orapki cert display Command Shows Additional Certificate Attributes

The orapki cert display -cert <file> command has been enhanced to display public key information along with existing certificate details. Specify the -complete and -details options with orapki cert display -cert <file> to display the additional attributes in the command output.

This feature lets you verify certificate strength directly from the orapki utility, which makes security validation and certificate hardening easier without needing a separate tool.

orapki wallet p11_verify Reports Native Failure

The orapki wallet p11_verify command now reports an error when native PKCS#11 verification fails instead of allowing the failure to go undetected or be reported unclearly.

This feature makes PKCS#11 wallet verification failures visible, so you can identify and troubleshoot verification issues more quickly. Clearer error reporting reduces confusion during wallet validation.

View Documentation

Scheduler Single Named Destination Privilege Enforcement

Scheduler privilege validation has been updated for jobs that use a single named destination. When you enable or run one of these jobs, Scheduler validates that the job owner has the required privileges. CREATE ANY JOB authorizes the use of single named destinations in another user’s schema. For SYS-owned single named destinations, the job owner must have ALTER privilege on the destination object.

This update improves security by ensuring that jobs can be enabled or run against protected SYS single named Scheduler destinations only when the job owner has the required object-level privileges. Existing behavior for non-SYS single named destinations is unchanged.

View Documentation

Security Hardening of Database Vault Authorization on Scheduler Jobs

Before this release, CREATE, DROP, ALTER, ENABLE, and DISABLE operations performed through the DBMS_SCHEDULER APIs on certain Database Vault realm-protected objects might not have been enforced correctly. This update strengthens the internal realm authorization checks to ensure that Database Vault policies are applied consistently. As a result, operations that previously succeeded may now fail with ORA-01031: insufficient privileges when performed on realm-protected objects without the required realm authorization. In such cases, customers must grant the appropriate users the necessary authorization for the corresponding Database Vault realm.

View Documentation

Security Hardening on XS$NULL

Real Application Security (RAS) application users can no longer grant or revoke ON USER privileges for XS$NULL. If these operations are required, they must be performed by a sufficiently privileged database administrator, such as a user with the GRANT ANY OBJECT PRIVILEGE system privilege.

Silent Installer Password Prompting

Supported silent Grid Infrastructure and Oracle Database installer runs can collect applicable passwords through console or standard input (stdin) prompts instead of requiring all passwords to be supplied in advance. Automation that uses these prompt flags must be able to handle prompt input and password confirmation failures.

This change reduces the need to store passwords in response files or command-line arguments, providing a more flexible and secure automated installation workflow.

Unified Auditing for FLASHBACK_TRANSACTION_QUERY Privilege Use

Unified auditing now records the use of the SELECT ANY TRANSACTION privilege when accessing FLASHBACK_TRANSACTION_QUERY.

This feature provides administrators with more complete audit visibility for privileged access to historical transaction data.