Oracle 19c / 21c Sharding Component Password Hash Exposure

Posted on 26 October 2023

Oracle database versions 19.3 through 19.20 and 21.3 through 21.11 have an issue where an account with create session and select any dictionary can view password hashes stored in a system table that is part of a sharding component setup.