Security Vulnerabilities

[babloo2642]

Hi Team,

I have scanned Enterprise Edition Oracle 19.30.0.0.0 (latest RUs applied) and seeing 1 Critical
End-of-Life Version of Operating System and 10+ high vulnerabilities

Do you have a plan to fix security vulnerabilities ?

Thanks in Advance,
Babloo.

[yunus-qureshi]

Which image did you scan?
container-registry.oracle.com/database/enterprise_ru:19.30.0.0 ?

[babloo2642]

Yes, correct.

[yunus-qureshi]

Which tool did you use to scan the images? and share the vulnerabilities reported.

[babloo2642]

We use WIZ tool to scan it. Please find vulnerabilities reported below:

[babloo2642]

Hi,

Is it possible to update the base image from OracleLinux 7 to 9 in Dockerfile ?

Thanks in Advance.

[yunus-qureshi]

Thanks. Yes, that's the plan

[aditya059]

Hi @babloo2642

Is this scan result for 19.30 (container-registry.oracle.com/database/enterprise_ru:19.30.0.0)? I see OL 8.10 in your screenshot while we release 19.30 with OL9 as you can see below

-bash-4.4$ podman run -td --name db19.30 container-registry.oracle.com/database/enterprise_ru:19.30.0.0
Trying to pull container-registry.oracle.com/database/enterprise_ru:19.30.0.0...
Getting image source signatures
Copying blob 194ff66ec4e9 skipped: already exists  
Copying blob 7d48a00c71b6 skipped: already exists  
Copying blob e8532a2f2271 skipped: already exists  
Copying blob 3a331acbec6c skipped: already exists  
Copying blob 119611c9d2d8 skipped: already exists  
Copying blob e6cd078e43c0 skipped: already exists  
Copying blob 542e614b4e6d skipped: already exists  
Copying blob ea6dec872af1 skipped: already exists  
Copying blob d24f1d02fc98 skipped: already exists  
Copying blob f0c400e05c40 skipped: already exists  
Copying blob 9025fa4ede94 skipped: already exists  
Copying blob 348d197f2df7 skipped: already exists  
Copying blob c70f17d23e74 skipped: already exists  
Copying blob a1bdd65be51f skipped: already exists  
Copying blob 3a36ccbe72ad skipped: already exists  
Copying blob 5d6f94557b09 skipped: already exists  
Copying blob 582aadc0c0bc skipped: already exists  
Copying blob bd9ddc54bea9 skipped: already exists  
Copying blob a6dfdb139f97 skipped: already exists  
Copying blob 6ff474529e3f skipped: already exists  
Copying blob e98206786aed skipped: already exists  
Copying blob f2f0f67ef05d skipped: already exists  
Copying blob 68c3b1c25fd8 skipped: already exists  
Copying blob 369fca3888ce skipped: already exists  
Copying config e5f55e6e27 done   | 
Writing manifest to image destination
e770dc56ae8e813251cff03a300bf345229cca992f340adf1f811244e1fe93cf
-bash-4.4$ 
-bash-4.4$ 
-bash-4.4$ 
-bash-4.4$ 
-bash-4.4$ podman exec -it db19.30 bash
bash-5.1$ 
bash-5.1$ 
bash-5.1$ cat /etc/oracle-release
Oracle Linux Server release 9.7

[babloo2642]

Hi @aditya059,

Image I'm using:
container-registry.oracle.com/database/enterprise_ru:latest-19 e5f55e6e2716 7 weeks ago 8.82GB

I see OL 7.9 in my env:
bash-4.2$ cat /etc/oracle-release
Oracle Linux Server release 7.9
bash-4.2$ sqlplus / as sysdba

SQL*Plus: Release 19.0.0.0.0 - Production on Wed Apr 1 04:00:12 2026
Version 19.30.0.0.0

Copyright (c) 1982, 2025, Oracle. All rights reserved.

Connected to:
Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production
Version 19.30.0.0.0

SQL>

Thanks in advance.

[aditya059]

Hi @babloo2642,

Tried it again. Its correct for me. Can you try "podman pull container-registry.oracle.com/database/enterprise_ru:latest-19". Maybe you have some old cached image. In OCR, 19.30 have OL9 as base OS.

-bash-4.4$ podman run -td --name 19.30 container-registry.oracle.com/database/enterprise_ru:latest-19
Trying to pull container-registry.oracle.com/database/enterprise_ru:latest-19...
Getting image source signatures
Copying blob 194ff66ec4e9 done |
Copying blob 542e614b4e6d done |
Copying blob 7d48a00c71b6 done |
Copying blob 119611c9d2d8 done |
Copying blob 3a331acbec6c done |
Copying blob e8532a2f2271 done |
Copying blob e6cd078e43c0 done |
Copying blob ea6dec872af1 done |
Copying blob d24f1d02fc98 done |
Copying blob 9025fa4ede94 done |
Copying blob 369fca3888ce done |
Copying blob 348d197f2df7 done |
Copying blob c70f17d23e74 done |
Copying blob a1bdd65be51f done |
Copying blob f0c400e05c40 done |
Copying blob 3a36ccbe72ad done |
Copying blob 5d6f94557b09 done |
Copying blob 582aadc0c0bc done |
Copying blob bd9ddc54bea9 done |
Copying blob a6dfdb139f97 done |
Copying blob 6ff474529e3f done |
Copying blob e98206786aed done |
Copying blob f2f0f67ef05d done |
Copying blob 68c3b1c25fd8 done |
Copying config e5f55e6e27 done |
Writing manifest to image destination
d2090c35a48e61e74076cd9b8c2f14229c02157a40535fc104a47edd9f3ad428
-bash-4.4$
-bash-4.4$
-bash-4.4$
-bash-4.4$ podman exec -it 19.30 bash
bash-5.1$
bash-5.1$
bash-5.1$ cat /etc/oracle-release
Oracle Linux Server release 9.7
bash-5.1$ sqlplus / as sysdba

SQL*Plus: Release 19.0.0.0.0 - Production on Wed Apr 1 05:25:29 2026
Version 19.30.0.0.0

Copyright (c) 1982, 2025, Oracle. All rights reserved.

Connected to an idle instance.

SQL> exit
Disconnected
bash-5.1$ exit
exit
-bash-4.4$ podman images
REPOSITORY TAG IMAGE ID CREATED SIZE
container-registry.oracle.com/database/enterprise_ru latest-19 e5f55e6e2716 7 weeks ago 8.87 GB

[babloo2642]

Hi @aditya059,

I have update the image and I see that OS is updated now.
bash-5.1$ cat /etc/oracle-release
Oracle Linux Server release 9.7

I see that critical vulnerability for OS has been fixed but I still see some high vulnerabilities below:

I tried to update the image with
Dockerfile

1. Start from the official Oracle image

FROM container-registry.oracle.com/database/enterprise:19.19.0.0

2. Switch to the root user to install updates

USER root

3. Run the OS update command to fix RPM vulnerabilities

RUN yum update -y && yum clean all

4. Switch back to the default oracle user

USER oracle
~
but seeing the error below:

STEP 1/4: FROM container-registry.oracle.com/database/enterprise:19.19.0.0
Trying to pull container-registry.oracle.com/database/enterprise:19.19.0.0...
Getting image source signatures
Copying blob sha256:3dc8585d2fa4fd6ca035dbcf076f08ff38535493d82d5d885c07cd668ca1a82e
Copying blob sha256:c8b951f2ad9b50ee58f141c8f47c92a05beeef0b7aa7e30e15307409ed483a16
Copying blob sha256:9549f8df523e70907b977416437b3fae7db45ec8801a4dc26f0fb40814738ae4
Copying blob sha256:b43e3eb7b1d303e4d323a674b6d3d65519719b86f7b6ba61c69915b5032182ec
Copying blob sha256:e46d7f9d5c4f20d95f8ec5bacc0022896dde1eb33434f668cd8cc9e4db0c14d8
Copying blob sha256:de2190b9815bc2d8aec52c3561ab93a3ff6efc6a2a14956cd96e2bba86922e36
Copying blob sha256:c301dd6dd44c79601d140bfb9d436981aec2568c7ef83ab983d14217ffe3e292
Copying blob sha256:833db2586c3100afe59be591106afdda648607838bb1d094479b1730363f92de
Copying blob sha256:0af0fd251a0a71f63a835ff6db912f44a8755f4d6bd5bc6621683be8bcc80c7e
Copying blob sha256:8c1944c696cd05ec849da2a4c2f1a4b891e119b7eb3ae2898984d6c00ccac79c
Copying blob sha256:14ad2516f4a06b7d577618d410bd22e34f1662b93ef4fbd26eb5b56b2df39cb2
Copying blob sha256:072ff07ca20b7ca2e10e9afac41d12d9d18959eab1caca7a64a94a319e220f68
Copying blob sha256:9a93a5503b5aeb4cd2d40c0c2b648598dbd7f5f0cce78eb2f786c1565f626cfc
Copying blob sha256:601a4de1daee28afd9fcf8c2122aa280a797f5922a5a81616e702145243e50ca
Copying blob sha256:61c45e4e9c5bca0f9c14b028692e593138240bc4e6404a796835139d1b5fc7ec
Copying blob sha256:6a387bdcf926800abc8e454e575ae8227a15fe0ab93d4a1e5f7174c12377f561
Copying blob sha256:5920643102f5a515c163df8d309b2e42088a358615a35c5b00c2461c00402af8
Copying blob sha256:5ed12af88c08a67a3ddb3625fb000445539bfa4a47ea266d74803957e9e6b916
Copying blob sha256:4359a73546412e520233ef364413cdb5a8284274966fc4d996ffc332ee473508
Copying config sha256:5e85749c169fc6b0ffeb5465c5d843d42c43bc752842c724cf501857e2b95b7a
Writing manifest to image destination
STEP 2/4: USER root
time="2026-04-08T12:22:36-07:00" level=warning msg="HEALTHCHECK is not supported for OCI image format and will be ignored. Must use docker format"
--> 28d1102bfc2c
STEP 3/4: RUN yum update -y && yum clean all
Oracle Linux 8 BaseOS Latest (aarch64) 0.0 B/s | 0 B 01:59
Errors during downloading metadata for repository 'ol8_baseos_latest':

• Curl error (7): Couldn't connect to server for https://yum-us-phoenix-1.oracle.com/repo/OracleLinux/OL8/baseos/latest/aarch64/repodata/repomd.xml [Failed to connect to yum-us-phoenix-1.oracle.com port 443: Connection timed out]
  Error: Failed to download metadata for repo 'ol8_baseos_latest': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried
  Error: building at STEP "RUN yum update -y && yum clean all": while running runtime: exit status 1

Please let me know how I can fix the vulnerabilities.

Thanks in Advance.

[yunus-qureshi]

Delete this line
echo "-$region" > /etc/yum/vars/ociregion

from setupLinuxEnv.sh

and retry