Skip to main content
M
miki
Known Participant
August 11, 2026

CF 2023 patch 23, downloaded file does not match hash.

  • August 11, 2026
  • 返信数 1.
  • 22 ビュー

Today i received Adobe Security Bulletin indicating a priority 1 patch had been released for ColdFusion.  I reviewed the list of critical vulnerabilities patched and immediately started to patch my servers. 

I have a secure server, so i cannot use the CF Administrator to install. 

I referred to https://guides.adobe.com/coldfusion/en/docs/introduction-to-coldfusion/coldfusion-2023-updates.html and downloaded the hotfix jar and the packages zip.  

However the hash published on that page for the hotfix and packages repository:

“Hotfix and packages repository - link - (MD5:651E86B76AF4D405EAB2D177EC82EAE3”

does not match the hash i generated after downloading the file. (I tried it multiple times, downloading from the web browser and via curl. I even tried downloading the packages to a personal device. The file size is always consistent, however the hash does not match. I can find no other hash.  

Below are the results of my download, the file sizes of downloaded files and the hash results.

command prompt visual with some information redacted showing the curl call that downloaded the file, the results of the download, a dir command for all files matching the pattern “hot*” that returns the two files downloaded, with the relevant file: hotfix-packages-cf2023-023-330940.zip, with size of 926,087,569 bytes  followed by a certutil command that compares the hash to the published one “651E86B76AF4D405EAB2D177EC82EAE3” and returns no results and finally an unrestricted certutil command that returns value MD5 value “2805cb4ace42b63fe8d66a741ece6f8f”

Given the purpose of hashes in security; I am loathe to install code that doesn’t match the published hash unless i have something from Adobe telling me the correct hash. Can anybody either point me to a copy of hotfix-packages-023-330940.zip that matches the published hash or the correct hash for verifying the files.

Please advise

    返信数 1

    M
    miki作成者
    Known Participant
    August 12, 2026

    the page https://guides.adobe.com/coldfusion/en/docs/introduction-to-coldfusion/coldfusion-2023-updates.html has been updated with a different hash

      契約条件Accessibility statement
      Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices