To fix the reason for the security audit, found that there is a xs$null user in the database, try to modify the password for it, found an error. Even the SYS user cannot modify the password of the Xs$null User:
Sql>--11.2.0.4
sql> alter user xs$null identified by Oracle;
Alter user xs$null identified by Oracle
*
ERROR at line 1:
Ora-01031:insufficient Privileges
Sql>--12.1.0.2
sql> alter user xs$null identified by Oracle;
Alter user xs$null identified by Oracle
*
ERROR at line 1:
Ora-28222:may not modify reserved user
Sql>
The online documentation says this is an internal retention account, which is not a user, allowing only Oracle instance access and cannot be accessed externally.
Cannot Alter User xs$null (Doc ID 1325766.1) This document also illustrates the problem.
Therefore, Xs$null is not allowed to alter the operation. This is Oracle's expected behavior.
Only at 11.2.0.2, because of bug 12822989, it can be modified by the password command. But the bug does not exist on the 11.2.0.4.
Sql>--11.2.0.2
sql> Password Xs$null
changing password for Xs$null
New Password:
Retype new Password:
Password changed
Sql>