Security scan reports multiple JRE related vulnerabilitie CVE-2024-21235, CVE-2024-21208 ,CVE-2024-21210, CVE-2024-21217, CVE-2024-21211

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Multiple Java Runtime Environment (JRE)  Security vulnerabilities were reported in Aria Automation Orchestrator 8.18.1

Environment

Aria Automation Orchestrator 8.18.1

Resolution

The JVM on which Orchestrator runs is OpenJDK and not Oracle JVM .
These is deemed as a false positive on the security scanner scanned report because Aria Orchestrator does not run on Oracle JVM.