Re: Adobe Coldfusion Update (Security Issue)

BKBK · ‎Dec 25, 2024

Still working out issues with package updates, but I think the automatic uninstall of pmtagent might have something to do with the latest security patch? Also, the new instance I created is running but the connector is denying access to any urls using CFIDE. This is new for me and likely for security but I have legacy sites that hardcoded paths to the ajax scripts and these are now broken. Per a post I replaced the isapi_redirect.dll with the older one that did work and restarted everything and access is still blocked? Is there any workaround or am I missing something? By @forrestmahannah We might get a clue from the logs or from the ColdFusion Administrator. However, you seem to have overlooked the 5 pieces of information I requested. In spite of reminders from Charlie.

BKBK · ‎Dec 24, 2024

@forrestmahannah , I am sorry to hear that you're still having problems with installing the packages. Let's have a look together. Restart the ColdFusion installation that is giving problems. Then share the following files with the forum: /logs/cfpm-audit.log; /logs/http.log; /lib/neo-updates.xml; A printscreen of the page you get when you navigate in the ColdFusion Administrator to Package Manager > Packages > Installed Packages (including all the displayed packages) ; A printscreen of the page you get when you navigate in the ColdFusion Administrator to Package Manager > Packages > Available Packages (including all the displayed packages) ;

BKBK · ‎Dec 24, 2024

Hi Simon, ColdFusion 2023 is apparently not threatened by this. See the new thread on Apache Tomcat 9.0.98.

BKBK · ‎Dec 24, 2024

The key to the Apache Tomcat 9.0.98 fix is the Java version. See https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.98 . This documentation tells us that, using the default Java settings implemented in ColdFusion, the issue is only relevant for ColdFusion 2021 or older. They are the ones that use Java 8 and Java 11. A summary of the fix is: For Java 8 or Java 11 (ColdFusion 2021 or older): the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true); For Java 17 (ColdFusion 2023): the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false). For Java 21 onwards (ColdFusion 2025): no further configuration is required (the system property and the problematic cache have been removed) In short, if you're on ColdFusion 2021 or older, you can mitigate this issue by adding the flag -Dsun.io.useCanonCaches=false to the JVM settings in the jvm.config file.

BKBK · ‎Dec 24, 2024

Hi @forrestmahannah , Yes, it is normal to see read time-outs during the download process. The repository usually renews and updates its contents.

BKBK · ‎Dec 24, 2024

@Rahul_Raj0044 , I would strongly advise you not to install ColdFusion 2023 on Windows Server 2012. You have to use Windows Server 2016, 2019 or 2022 instead. That's what you will see when you follow the link supplied by Priyank. Why not Windows Server 2012 (R2)? Perhaps the most important consideration of all is that Microsoft no longer supports Windows Server 2012. Support for Windows Server 2012 and Windows Server 2012 R2 ended on October 10, 2023. After that date, Windows Server 2012 and Windows Server 2012 R2 no longer receive security updates, non-security updates, bug fixes, technical support, or online technical content updates. Why Windows Server 2016, 2019 or, preferably, 2022? ColdFusion 2023 relies on modern features, security patches and optimizations in Operating Systems, that may not be available or fully functional on Windows Server 2012. For example, the newer Operating Systems offer, to name but a few: Greater performance: (enhanced memory, CPU, and storage management), Built-in hybrid Cloud support , Improvements in virtualization (Hyper-V), Support for modern containerization technology (e.g., Docker, Kubernetes), Improved security (Windows Defender ATP, HTTP 2, TLS 1.2 and above).

BKBK · ‎Dec 24, 2024

@harshp_0559 , I am glad to hear that the packages can now be installed. You may ignore the warning, " Unable to determine dialect of the StAX implementation at...". I explain why in a previous thread on the STAX warning.

BKBK · ‎Dec 22, 2024

@forrestmahannah , you are right. There seems to be something wrong with the installation of packages in ColdFusion 2021. The same issue emerged in a recent discussion about packages failing to install during a ColdFusion 2021 update. I offered a possible solution there. Try it and let us know how it goes.

BKBK · ‎Dec 21, 2024

@harshp_0559 , Are you looking for a possible solution to the problem of packages not being installed on ColdFusion 2021? Then read on. It would be handy to update Java to the most recent version, namely, Java SE 11.0.22 (LTS). But I think that this can wait till later. I say this because I think the Java version is not the cause of the current problems. I think @Dave Watts puts his finger on the root cause. Namely, your ColdFusion 2021 installation does not have access to the current packages, such as felixclassloader-2021.0.02.328618.jar. There is a possible source of confusion, which can cause such issues: the URL https://www.adobe.com/go/coldfusion-updates. ColdFusion 2021 uses this URL in neo_updates.xml and in other settings. The trouble is, ColdFusion has since been upgraded to ColdFusion 2023, and ColdFusion 2023 uses the same URL Hence using the URL on ColdFusion 2021 will cause a mix-up. In any case, there is one way to correct the packages issue. It consists of downloading all the current ColdFusion 2021 packages yourself. To do so, proceed as follows: Stop ColdFusion. Delete the Felix cache using either of the two ways previously described in this thread. Check to make sure the directory D:/ColdFusion2021/bundles/ exists. If it does, then back it up by moving it, with all its contents intact, to a location outside ColdFusion. Then ensure that D:/ColdFusion2021/bundles/ is empty. If the directory doesn't exist to start with, then that is already an issue. In that case, create the directory. Check the firewall rules and ensure that ColdFusion has full access to D:/ColdFusion2021/bundles/. Open the Command Prompt (cmd) as Administrator; Use the DOS cd command to navigate to {CF2021_HOME_DIR}/cfusion/bin; Type cfpm and press ENTER. You should get ColdFusion's package manager prompt cfpm; Now use the downloadrepo command to download the packages repository. To do so, type downloadrepo D:\ColdFusion2021\bundles and press ENTER. It may take up to half an hour for the download to complete. So be patient. The cfpm cursor will reappear when the download is complete. Verify that the directory D:/ColdFusion2021/bundles indeed contains the downloaded packages. Edit /lib/neo-updates.xml and make sure it contains the following: <packagesurl>file:///D:/ColdFusion2021/bundles/bundlesdependency.json</packagesurl> <defaultpackagesurl>file:///D:/ColdFusion2021/bundles/bundlesdependency.json</defaultpackagesurl> 11. Restart ColdFusion 2021. 12. Check whether ColdFusion 2021 now works as expected.

BKBK · ‎Dec 20, 2024

The Adobe team should, in any case, do a review of the changes in log4j (implementation, configuration and settings) in Update 13 of ColdFusion 2021.

BKBK · ‎Dec 20, 2024

True, manually deleting the Felix cache folder has the same aim as running cfpm purgecache. However, the two methods work differently. The first is done manually by the developer. on the Operating System. The second is performed programmatically by the ColdFusion Package Manager application. The two scenarios are therefore different. Since there is an issue with packages, of which we don't know the cause, it makes sense to try both ways of purging the Felix cache.

BKBK · ‎Dec 20, 2024

Hi Simon, Alas, no. It is not accepted practice to update Apache Tomcat directly in Coldfusion 2023 yourself. The reason is complexity. You don't know - and so cannot take care of - the many dependencies that must be satisfied when Tomcat is integrated in ColdFusion. The Adobe team knows, of course. Which is why it is their responsibility to update the Apache Tomcat version.

BKBK · ‎Dec 20, 2024

@Ali Sozkesen Can you please DM me and I will share my email ID with you? So we can take this offline and share this with engineering. By @Priyank Shrivastava. Hi @Priyank Shrivastava. , could your colleagues in engineering please look into my earlier suggestion: @BKBK: "I suspect that this has to do with the recent changes in log4j. So ... review the settings within /lib/log4j.properties, /lib/log4j2.properties and /lib/logging.properties, as well as the required JVM flags."

BKBK · ‎Dec 19, 2024

Hi Simon, thanks for the alert. The current fix for "important" issues is Apache Tomcat 9.0.98

BKBK · ‎Dec 19, 2024

At this point I would also suggest, as does Charlie, that you: delete ColdFusion2021\cfusion\bin\felix-cache, and then restart ColdFusion. If the errors continue, then that would suggest that the manual process isn't working properly. There is another way. Do the following (to purge the Felix cache programmatically): Stop ColdFusion. Open the Command Prompt (cmd) as Administrator; Use the DOS cd command to navigate to {CF2021_HOME_DIR}/cfusion/bin; Type cfpm and press ENTER. You should get ColdFusion's package manager prompt cfpm; Type purgecache and press ENTER. (This runs the command to purge the Felix cache) Restart ColdFusion. Is everything OK now?

BKBK · ‎Dec 18, 2024

Hi @harshp_0559 , the object-instantiation error makes me wonder whether some packages, such as those required for Mail and Print, are missing. I would therefore suggest that you install all the packages. At least, to start with. Assuming you are on Windows, you could do the following: Open the Command Prompt (cmd) as Administrator; Use the DOS cd command to navigate to {CF2021_HOME_DIR}/cfusion/bin; Type cfpm and press ENTER. You should get ColdFusion's package manager prompt cfpm; Run the command install all 5. Keep running the command install all till the result is either an irreversible error or ColdFusion tells you that "All the packages are already installed". 6. If the former, then share the error message with the forum. If the later, then restart ColdFusion in the usual way, and you're set to go.

BKBK · ‎Dec 18, 2024

Hi @calm_Eagle3816 , thanks for the update.

BKBK · ‎Dec 14, 2024

Could it be that the CF2021 installation is using a mapping of some sort? One way to find out: run the following on a CFM page <cfset scriptsDirPath=expandPath('\MyScriptDir')> <cfif directoryExists(scriptsDirPath)> <cfoutput> <p>The scripts directory is #scriptsDirPath#.<p> </cfoutput> <cfelse> <cfoutput> <p>The scripts directory #scriptsDirPath# does not exist.<p> </cfoutput> </cfif>

BKBK · ‎Dec 13, 2024

Hi @rickmaz , The cfmx_compat algorithm has served ColdFusion well, but is no longer secure and so is due for change. Therefore I would strongly advise you to replace it with the new algorithms. It is definitely not waste and pain. Improving your code in this way is actually an investment in the long run. Not only ColdFusion, but every programming language evolves. Generally for the better. We, developers, should therefore expect to change our software as time goes on. In fact, if you think that you can avoid such maintenance, you are mistaken. Benjamin Franklin once wrote to a friend, "... in this world nothing can be said to be certain, except death and taxes". That is also true in the world of software: nothing can be said to be certain, except maintenance costs and end-of-life. Research shows that 60 to 80% of the total lifecycle costs of a software application is spent on maintenance. For further information on this research, see the following: Software Engineering Economics and COCOMO research by Barry Boehm Software Maintenance: Concepts and Practice, by Penny Grubb and Armstrong A Takang Software Cost and Effort Estimation: Current Approaches and Future Trends, by IEEE

BKBK · ‎Dec 13, 2024

Excellent innavations. To maintain compatibility with old applications, will it be possible to use Java17 or not? By @Paolo Olocco Short answer: no. By this I mean: it might be possible, but it wouldn't be a good thing. Your question mixes two separate factors: compatibility and version. Java and ColdFusion are two separate programming languages. ColdFusion's compatibility - backward or forward - depends on the ColdFusion version and Java's compatibility depends on the Java version. You should not mix the two. However, ColdFusion uses Java. As such, it evolves along with the Java version. Any big changes in the Java language, such as in security or in the HTTP/TCP protocols, will have an impact on ColdFusion. That way, ColdFusion continually benefits from the new advances and features in the Java language. That is the reason why new ColdFusion versions are customarily optimized to run on a recent Java version. Hence, if ColdFusion 2025 is designed to run on Java 21, it will be sub-optimal to run it on Java 17.

BKBK · ‎Dec 12, 2024

What version java jdk did you install? By @calm_Eagle3816 Java SE 11.0.25 (LTS)

BKBK · ‎Dec 12, 2024

Historic changes involving quite some pruning. Good work, Team Adobe!

BKBK · ‎Dec 12, 2024

The original problem shows the importance of doing updates in time - and across the board, too. So I would do the following: Update ColdFusion 2021 to the latest update level, which is Update 17. Update the Java on which ColdFusion 2021 runs to the latest official version, Java SE 11.0.25 (LTS). Include the required security certificates.

BKBK · ‎Dec 11, 2024

OK. I can confirm that I have tested your other jvm.config settings, and they work without any problems.

BKBK · ‎Dec 11, 2024

I don't think that Djdk.lang.Process.allowAmbiguousCommands had anything to do with ColdFusion not starting. I repeat my suggestion: your jvm.config setting Java.home=C:\\Programfiles\\java\jdk-11 is likely incorrect. Try instead: java.home=C:\\Program Files\\Java\\jdk-11 Please let us know whether that resolves the issue of ColdFusion starting. That is important information to share with us, fellow developers.

BKBK · ‎Dec 11, 2024

Is it now possible to start ColdFusion?

BKBK · ‎Dec 11, 2024

Try java.home=C:\\Program Files\\Java\\jdk-11

BKBK · ‎Dec 11, 2024

I have given you a suggestion about that. A mistake probably occurred in jvm.config when you modified it. The most likely culprit is the setting java.home.

BKBK · ‎Dec 11, 2024

The Coldfusion application service did not start By @calm_Eagle3816 That means there is likely an error in the settings in jvm.config. Take a good look at the contents of the file. Could you share the contents with the forum?

BKBK · ‎Dec 11, 2024

The logs might tell you why ColdFusion didn't start. So, what do the logs say?

BKBK

BKBK

Activity

Re: Adobe Coldfusion Update (Security Issue)

Re: Adobe Coldfusion Update (Security Issue)

Re: ColdFusion CF2023 enterprise Tomcat vulnerabil...

Re: CF2021 Tomcat < 9.0.98 is this vulnerable to C...

Re: Adobe Coldfusion Update (Security Issue)

Re: Windows server support

Re: Adobe Coldfusion Update (Security Issue)

Re: Need help with CF Performance Monitoring Toolk...

Re: Adobe Coldfusion Update (Security Issue)

Re: ColdFusion (2021 release) Update 11 Stops cold...

Re: Adobe Coldfusion Update (Security Issue)

Re: ColdFusion CF2023 enterprise Tomcat vulnerabil...

Re: ColdFusion (2021 release) Update 11 Stops cold...

Re: ColdFusion CF2023 enterprise Tomcat vulnerabil...

Re: Adobe Coldfusion Update (Security Issue)

Re: Adobe Coldfusion Update (Security Issue)

Re: CF 2021 - HmacPBESHA256 Not Available - JDK Up...

Re: Changed cf_scripts location, unable to login t...

Re: Important notice: Upcoming deprecations and re...

Re: Important notice: Upcoming deprecations and re...

Re: CF 2021 - HmacPBESHA256 Not Available - JDK Up...

Re: Important notice: Upcoming deprecations and re...

Re: CF 2021 - HmacPBESHA256 Not Available - JDK Up...

Re: CF 2021 - HmacPBESHA256 Not Available - JDK Up...

Re: CF 2021 - HmacPBESHA256 Not Available - JDK Up...

Re: CF 2021 - HmacPBESHA256 Not Available - JDK Up...

Re: CF 2021 - HmacPBESHA256 Not Available - JDK Up...

Re: CF 2021 - HmacPBESHA256 Not Available - JDK Up...

Re: CF 2021 - HmacPBESHA256 Not Available - JDK Up...

Re: CF 2021 - HmacPBESHA256 Not Available - JDK Up...