
DBMS_METADATA.GET_DDL Does Not Return Hashed Passwords Anymore
Recent Oracle Data Pump patches (19.17 and later, involving bug fix 33517865) have modified the behavior of DBMS_METADATA.GET_DDL, removing hashed passwords from its output as a security enhancement. Previously, users with the EXP_FULL_DATABASE role could easily access this data. Now, even with that privilege, hashed passwords are inaccessible unless explicit access to SYS.USER$ is granted. Oracle has introduced a fix (bug fix 35018026) that allows access to hashed passwords under strict conditions. Alternatively, a definer-rights PL/SQL function can be used to provide controlled access to this information.





