Oracle Critical Patch Update – July 2015

Last week on July 14, Oracle released it’s quarterly Critical Patch Update.  The following Hyperion and BI products are affected by security vulnerabilities:

  • Hyperion Essbase
  • Hyperion Shared Services
  • Hyperion EPMA
  • OBIEE

Hyperion Essbase

There are patches available to fix the vulnerabilities in Essbase for the 11.1.2.2 and 11.1.2.3 versions. The patch for version 11.1.2.3 are the 11.1.2.3.506 Patch Set Update (PSU) for the Essbase Server and Essbase Client (patch numbers 20184072 and 20184082, respectively).  The vulnerability fix for Essbase version 11.1.2.2 is “Upgrade to Hyperion Essbase 11.1.2.3, then apply the patches listed above”.  If you are on an older version of Essbase than 11.1.2.3, it is time to upgrade.

Hyperion Shared Services

The CPU document calls this “Hyperion Common Security,” but they are talking about Shared Services. The vulnerability is listed as affecting versions 11.1.2.4, 11.1.2.3, and 11.1.2.2.  The patch for version 11.1.2.4 is listed as patch number 20876722. This one is interesting because if you search, that patch doesn’t bring anything up on the My Oracle Support site. I also searched for Shared Services patches under 11.1.2.4, but there isn’t even an 11.1.2.4 version available to choose yet.  Edit 7/22/15 – The Shared Services 11.1.2.4.001 patch (number 20876722) came out on 7/21 and is available on My Oracle Support. The 11.1.2.3 patch is the Shared Services 11.1.2.3.700 PSU (number 20675028). That PSU requires patching nearly every EPM product in your environment but gives the ability to run Internet Explorer 11 in its native mode – no more Enterprise Mode needed for 11.1.2.3.  The 11.1.2.2 patch is listed as number 21052487, but this is a bad patch number as well with no results when using their link.

Hyperion Enterprise Performance Management Architect

The EPMA vulnerabilities affect both versions 11.1.2.2 and 11.1.2.3.  In version 11.1.2.3, you have two different options to fix the vulnerabilities: EPMA PSU 11.1.2.3.501 (patch number 19466859) or EPMA PSU 11.1.2.3.700 (patch number 20929659).  If you are on version 11.1.2.2, a patch set update is available on request from Oracle.  I assume that you would need to submit an SR to get a PSU from Oracle Support for 11.1.2.2.

OBIEE

For version 11.1.1.9 of OBIEE, only a patch to Third Party BI software (patch number 21235195) is listed as a critical patch.

The following patches are listed to fix vulnerabilities in version 11.1.1.7:

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s