From:https://support.oracle.com
What is "Oracle javavm Component Database PSU"?
Oracle JAVAVM Component Database PSU is released as part of the Critical Patch Update program from October onwards.
IT consists of separate patches:
- One for JDBC clients-applicable to client, Instant client, Database and Grid oracle_homes.
This is a referred to as "JDBC Patch" in the rest of this document.
- One for the Oracle JAVAVM component within, the Oracle database-applicable to Database oracle_homes only.
This is referred to as "OJVM PSU" in the rest of this document.
As of January the "OJVM PSU" patches include all fixes from the "JDBC Patch".
For situations where the latest OJVM PSU cannot be installed immediately there are a "mitigation Patch" that can used.
OJVM PSU
OJVM PSU Patches:
- Include critical fixes for the Oracle JAVAVM component within the Oracle Database
- is packaged separately from the Database PSU (or equivalent) as they cannot BES installed in a RAC R Olling manner, nor in Standby first manner.
Keeping them separate allows customers to choose the most appropriate patching approach for each system
- Oracle has also released "Combo" patches this bundle the OJVM PSU in the same ZIP file as DB PSU and/or GI PSU for EAS E of Download. The OJVM component in these "Combo" patches are in a separate subdirectory with its own install steps still required. October "Combo" patches do not include the JDBC Patch.
- was applicable to all database installations regardless of which patching model is used (DB PSU, GI PSU, Security PATC H Update (SPU), Windows Bundle Patch or Database Patch for Exadata)
- Require the database home to being patched to at least October DB PSU (or equivalent)
- Include binary changes to is applied to the database Oracle_home, and "Post install" Steps to is execute on each database Running from the Oracle_home
- From January onwards:include the JDBC fixes
For situations where the latest OJVM PSU cannot being installed immediately there is a "mitigation Patch" so can be used as Describe below.
What's the "mitigation Patch"?
For situations where the latest OJVM PSU cannot be installed immediately there are a "mitigation Patch" that can used. The "Mitigation Patch" is a interim solution to protect against all currently known (Jul) Oracle JAVAVM sec Urity vulnerabilities in the database until such time as the OJVM PSU can be installed. It can also is used to protect database versions no longer covered by error correction support.
The "Mitigation Patch":
- is applicable only to database homes, not client nor Grid homes
- are only applicable to database s that is JAVAVM installed
- has a no dependency on the DB PSU (or equivalent ) level
- can be installed in a RAC rolling manner
- is a SQL only patch that needs to be installed and activated in each database
- hence it can installed standby first but it Requires SQL steps to is executed to be effective, which cannot is done with a read only standby
li>
- affects use of Java and Java development in the database
- has been Revie Wed for January, April, July, October, January, April and July and provides mitigation Against all currently known OJVM vulnerabilities
- can be downloaded Here: patch : 19721304
Read the "Using The Mitigation Patch" section later in this document to understand the impact of this patch.
JDBC Patch
The JDBC patches:
- Include security fixes for JDBC
(OCT patches include fixes for cve-2014-4289 and cve-2014-6544 only)
- is available packaged separately from the OJVM PSU and Database psu (or equivalent) for ease of deployment to CL ient environments
- is applicable to client, Instant Client and Grid oracle_homes The JDBC fixes is also applicable to the Database home reg Ardless of whether Oracle JAVAVM is used in a database or not:
- For October the JDBC Patch should also is installed in the Database home
- For January the OJVM PSU includes the JDBC fixes and so the JDBC patch does not need to being installed in the Database Home unless OJVM PSU is not being installed yet
- The JDBC Generic patches has been provided as a separate one-off from July so, all customers can install that WI Thout issue.
- was applicable to all installations regardless of which patching model is used (DB PSU, GI PSU, Security Patch Update (SPU), Windows Bundle Patch or Database Patch for Exadata)
- Has no dependency on OJVM PSU nor Database PSU (or equivalent) patch level
- can is installed in database server homes in a RAC rolling manner
- Do not require the database and listeners to is shutdown for patching in NON-RAC environments
- Do not require any post install steps is executed against individual databases
Latest JDBC Patch Availability information can be found in document:756671.1 "Oracle Recommended Patches-Oracle Databas E ".
Oracle Recommended Patches--"Oracle JAVAVM Component Database PSU" (OJVM PSU) patches (document ID 1929745.1)
