Summary

This article addresses the difference between Oracle Database (Unknown Component) and Unspecified Edition

Question

What is the difference between Oracle Database (Unknown Component) and Unspecified Edition?

Answer

In response to issues with recognition of Oracle Database, the following classifications were specified in the ARL:

1. Oracle Database (Unknown Component)
These are the replacements for the "unknown component/edition" records. The evidence here included too wide a range of items. Some of them were more than unknown components. They were clearly indicating an Oracle Database or some other component. When you see Unknown Component now, this means that it's unrecognized evidence that's not linked to a database, which should not be considered as a risk (Nicolas Rousseau: 2022/06/02: the Oracle Database unknown component will be soon classified as component, and no longer as commercial).

2. Oracle Database Unspecified Edition, e.g. "Oracle Database 10g R2", these are new to the ARL, and contain the evidence from the unknown component records that clearly indicate the presence of an Oracle Database, but do not have the edition. When we can see the evidence indicating an Oracle Database we need to be clear that is what we see. All of our focus should be put on these classifications, because it means that evidence has been found suggesting the presence of a database and there's an issue with the inventory.

These changes should provide a much clearer set of results from the ARL than was previously being generated.