Release Update 19.32
This page describes the features and behavior changes that are new in Release Update 19.32.
Behavior Changes
Release Update 19.32 introduces the behavior changes described below. Review each item before applying the Release Update (RU). Most changes affect behavior only when the relevant feature is in use. Where applicable, test application, administrative, audit, and connectivity workflows in a non-production environment before rollout.
BFILENAME Queries Excluded from the Database Result Cache
Behavior change: SQL statements that contain the BFILENAME function are no longer cached in the Database Result Cache and no longer display Result Cache information in their execution plans.
This change keeps execution plans accurate and prevents unsupported caching behavior for queries that reference external files, improving predictability and operational confidence.
Correct Audit Object Association for VPD/RLS-protected Objects
Behavior change: Audit records for access to objects protected by Oracle Virtual Private Database (VPD) or Fine-Grained Auditing (FGA) are now associated with the correct object.
Audit records and object-level policy evaluation remain accurate for queries protected by Oracle Virtual Private Database. This improvement helps administrators maintain accurate audit traceability and supports compliance reporting.
View documentation:
- Auditing of Oracle Virtual Private Database Predicates
- Fine-Grained Auditing on Tables or Views That Have Oracle VPD Policies
DBMS_REDEFINITION Enforcement of Database Vault Authorization
Behavior change: DBMS_REDEFINITION now enforces Database Vault checks before table redefinition operations proceed. When Database Vault is enabled, the user invoking table redefinition must now be authorized to access both the original table and any interim table used during the redefinition process.
This change applies to the following entry points in DBMS_REDEFINITION:
CAN_REDEF_TABLESTART_REDEF_TABLEREDEF_TABLEROLLBACKFINISH_REDEF_TABLE
The update checks Database Vault Realm, Command Rule, and Ops Control protections before allowing data movement between tables. If the user is not authorized under Database Vault, the operation is blocked and an appropriate error is returned. It prevents unauthorized use of table redefinition to move data out of Database Vault-protected tables or to alter protected table metadata without Database Vault authorization.
Expanded Default Password Detection in DBA_USERS_WITH_DEFPWD
Behavior change: Supported DBA_USERS_WITH_DEFPWD queries now return additional default password account findings and associated product labels for SYS, SYSTEM, and ADMIN account combinations.
This feature gives administrators a more complete view of default password risks and the related product context for remediation.
orapki cert display Command Shows Additional Certificate Attributes
Behavior change: The orapki cert display -cert <file> command has been enhanced to display public key information along with existing certificate details. Specify the -complete and -details options with orapki cert display -cert <file> to display the additional attributes in the command output.
This feature lets you verify certificate strength directly from the orapki utility, which makes security validation and certificate hardening easier without needing a separate tool.
orapki wallet p11_verify Reports Native Failure
Behavior change: The orapki wallet p11_verify command now reports an error when native PKCS#11 verification fails instead of allowing the failure to go undetected or be reported unclearly.
This feature makes PKCS#11 wallet verification failures visible, so you can identify and troubleshoot verification issues more quickly. Clearer error reporting reduces confusion during wallet validation.
Scheduler Single Named Destination Privilege Enforcement
Behavior change: Scheduler privilege validation has been updated for jobs that use a single named destination. When you enable or run one of these jobs, Scheduler validates that the job owner has the required privileges. CREATE ANY JOB authorizes the use of single named destinations in another user’s schema. For SYS-owned single named destinations, the job owner must have ALTER privilege on the destination object.
This update improves security by ensuring that jobs can be enabled or run against protected SYS single named Scheduler destinations only when the job owner has the required object-level privileges. Existing behavior for non-SYS single named destinations is unchanged.
Security Hardening of Database Vault Authorization on Scheduler Jobs
Behavior change: Before this release, CREATE, DROP, ALTER, ENABLE, and DISABLE operations performed through the DBMS_SCHEDULER APIs on certain Database Vault realm-protected objects might not have been enforced correctly. This update strengthens the internal realm authorization checks to ensure that Database Vault policies are applied consistently. As a result, operations that previously succeeded may now fail with ORA-01031: insufficient privileges when performed on realm-protected objects without the required realm authorization. In such cases, customers must grant the appropriate users the necessary authorization for the corresponding Database Vault realm.
Security Hardening on XS$NULL
Behavior change: Real Application Security (RAS) application users can no longer grant or revoke ON USER privileges for XS$NULL. If these operations are required, they must be performed by a sufficiently privileged database administrator, such as a user with the GRANT ANY OBJECT PRIVILEGE system privilege.
Unified Auditing for FLASHBACK_TRANSACTION_QUERY Privilege Use
Behavior change: Unified auditing now records the use of the SELECT ANY TRANSACTION privilege when accessing FLASHBACK_TRANSACTION_QUERY.
This feature provides administrators with more complete audit visibility for privileged access to historical transaction data.
New Features
Next-Generation Cryptographic Provider Announcement
Oracle Database 19c now supports a next-generation cryptographic provider based on OpenSSL (next-generation provider), in addition to the existing Dell BSAFE Crypto-C Micro Edition Suite, or MES (legacy provider).
This dual-provider architecture enables the following capabilities:
- TLS 1.3 protocol support
- FIPS 140-3 compliance (via OpenSSL 3.5.x FIPS provider)
- Post-Quantum Cryptography (PQC) algorithms for key exchange (ML-KEM) and digital signatures (ML-DSA)
- Hybrid key exchange groups that combine classic and post-quantum algorithms for quantum-resistant session establishment
The legacy provider remains the default. To switch to the next-generation provider, run the set_crypto_provider.py script and restart the database instance and Oracle Net listener. Only one cryptographic provider can be active at a time.