High priority patches from Oracle

[Former Member]

Hello,

We just migrated our SAP systems running on Oracle 11gr2 to new Hardware. Due to this our security team performed an audit of our system and the question of high priority patches came up. Specifically how does SAP handle high priority patches (database and OS) that are released from Oracle and is it possible to apply them immediately before SAP officially certifies them.

Thanks.

Arnie

[fidel_vales · Accepted solution]

Hi,

We do not "handle" security patches from OS, firmware or hardware.

Regarding the DB, we release every (almost) month what is called a SBP (SAP Bundle Patches) which contains "individual" patches from Oracle requestested by SAP plus the Oracle PSU (Patch Set Update)

The Oracle PSU contains the CPU (critical patch update) with security patches.

Oracle release such PSU/CPU every trimester.

Therefore, if you follow the SAP recomendation of having a current SBP, you should be cover