17 of 21 rules ran. The rest were never reached, because an
earlier stage settled the CVE, a distinct claim from a rule that ran and found nothing.
| # | Rule | Outcome | Status | Detail |
|---|
| identity: Does this identifier describe a vulnerability at all? first match wins |
|---|
| 1 |
rejected |
no-match |
|
CVE Program withdrawal of this identifier |
| scope: Is the vulnerability ARMR's to address? first match wins |
|---|
| 2 |
armr-patch-file |
no-match |
|
An ARMR patch file on disk for this CVE |
| 3 |
armr-secure-rule-file |
no-match |
|
An ARMR security-rule template on disk for this CVE |
| 4 |
manual-classification |
no-match |
|
A researcher's recorded decision for this specific CVE |
| 5 |
manual classification |
no-match |
|
Manual classification of this CVE in the legacy dataset |
| 6 |
non-java-upstream |
no-match |
|
A root cause in non-Java code: an OS kernel, a C library, or a bundled runtime |
| 7 |
oracle-component |
no-match |
|
The defect being in a component of a tracked product the agent does not reach: JavaFX, the Java SE installer, the native WebLogic proxy plug-in. Oracle gives these no CPE of their own and names them only in the description. |
| 8 |
osv-maven |
no-match |
|
An OSV.dev record of this CVE affecting a package published to Maven Central |
| 9 |
cna-maven-package |
no-match |
|
An affected Maven artifact named by the CNA itself |
| 10 |
known-cpe-product |
matched |
Queued for review |
Matches known products: sun/jre, oracle/jre |
| 11 |
cna-cpe-product |
not-reached |
|
A CPE the CNA published naming a tracked product. Oracle publishes these on advisory day, months before NVD. |
| 12 |
oracle-advisory-family |
not-reached |
|
A tracked product family named in Oracle's own risk matrix. CPE cannot carry a suite name, only a module. |
| 13 |
non-deployable-product |
not-reached |
|
The only affected product being a sealed appliance image, where Java runs but no -javaagent can be attached |
| 14 |
unmatched-product |
not-reached |
|
No tracked product matched above, and none present at all |
| disposition: What do we do about one that is? cumulative: every rule gets a turn |
|---|
| 15 |
patch-hint decided it |
matched |
Mitigation candidate |
References include candidate fix URL (bugzilla tier): https://bugzilla.redhat.com/show_bug.cgi?id=788994 |
| 16 |
open-source-maven |
skipped |
|
The affected package being open source on Maven, so the fix can be read |
| 17 |
poc-derivable |
skipped |
|
An indexed exploit to reverse-engineer, where there is no source to read |
| 18 |
no-exploit |
skipped |
|
With no fix path, a public exploit, or a CISA record of one |
| 19 |
secure-rule-match |
no-match |
|
A vulnerability class already blocked by an ARMR security rule |
| 20 |
below-action-threshold |
no-match |
|
Severity is CRITICAL — only MEDIUM/LOW are deprioritized |
| 21 |
no-exploit-published |
no-match |
|
A KEV listing, a CISA verdict of active exploitation, or a reviewed exploit catalogue carries this CVE — somebody has published a working exploit, so it stays a candidate |
What the scope rules read
The products the record named, and whether known-products.yaml tracks them.
This is the evidence the scope stage decided on.
| Vendor | Product | Tracked | CPE | Source |
|---|
| sun | jre |
tracked |
cpe:2.3:a:sun:jre:1.5.0:-:*:*:*:*:*:* |
yaml |
| oracle | jre |
tracked |
cpe:2.3:a:oracle:jre:1.6.0:update22:*:*:*:*:*:* |
yaml |
| debian | debian_linux |
not tracked |
cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* |
|
| suse | linux_enterprise_desktop |
not tracked |
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:* |
|
| suse | linux_enterprise_java |
not tracked |
cpe:2.3:o:suse:linux_enterprise_java:10:sp4:*:*:*:*:*:* |
|
| suse | linux_enterprise_server |
not tracked |
cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:* |
|
| suse | linux_enterprise_software_development_kit |
not tracked |
cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp1:*:*:*:*:*:* |
|
VRT
391,192 CVEs tracked ·
15,442 in RASP scope ·
data as of 17 hours ago