Skip to main content
Priyank Shrivastava.
Community Manager
Priyank Shrivastava.Community Manager
Community Manager
May 10, 2022
Question

UPDATE RELEASED: ColdFusion security updates 14 & 4 released for CF2021 & CF2018.

  • May 10, 2022
  • 6 replies
  • 5086 views

We are pleased to announce that we have released the updates for the following ColdFusion versions:

 

 

Note: The ColdFusion Add-Ons and lockdown installers are also refreshed. The refreshed installers are available at ColdFusion downloads.

 

In these updates, we’ve fixed a few security bugs, and upgraded Tomcat, along with other libraries.

 

 

These updates fix security vulnerabilities that are mentioned in the security bulletin,  APSB22-22.

 

The Docker images will be hosted shortly on Docker Hub.

 

Please update your ColdFusion versions and provide us with your valuable feedback.

 

    This topic has been closed for replies.

    6 replies

    P
    pfurrer
    Participating Frequently
    July 29, 2022

    I have the following problem: After installing update 14 (CF 2018 release, Windows Server 2016, patched), the CF-service starts normally but it is no longer possible to access it.

     

    - Connecting to the CF internal webserver throws an error 500
    - Connection through IIS triggers the following error in isapi_redirect.log:


    [info] jk_open_socket::jk_connect.c (816): connect to 127.0.0.1:8018 failed (errno=61)
    [info] ajp_connect_to_endpoint::jk_ajp_common.c (1140): (cfusion) Failed opening socket to (127.0.0.1:8018) (errno=61)
    [error] ajp_send_request::jk_ajp_common.c (1811): (cfusion) connecting to backend failed. Tomcat is probably not started or is listening on the wrong port (errno=61)
    [info] ajp_service::jk_ajp_common.c (2982): (cfusion) sending request to tomcat failed (recoverable), because of error during request sending (attempt=2)
    [error] ajp_service::jk_ajp_common.c (3003): (cfusion) connecting to tomcat failed (rc=-3, errors=10, client_errors=4).

     

    I've tried different things:
    - Uninstall the update manually (CF Admin not available): no change

    - Rollback + Installing the update manually: same result
    - Updating the connector, adopting various working settings from our testing-System (where the security update 14 was no problem): unfortunately no success

     

    My questions:

    - Is there also a log file form the CF internal webserver?

    - I suspect there is a problem with the Tomcat 9.0.60 update. Are there any specifig logs or test possibilities to identify the problem?

    Thanks,

    Patrick

    Vikram Kumar M
    Community Manager
    Vikram Kumar MCommunity Manager
    Community Manager
    July 29, 2022

    Hi Patrick,

     

    Could you please try to start the ColdFusion from the command prompt and share the output here?

     

    Open the command prompt as admin, navigate to \ColdFusion2018\cfusion\bin folder and run cfstart.bat and share the output.

     

    As per the connector logs, it appears like binding is failing.  Try adding the IP address in server.xml and worker.properties and see if it helps.

     

    Error:

    [info] jk_open_socket::jk_connect.c (816): connect to 127.0.0.1:8018 failed (errno=61)

     

    Add the IP address of the machine instead of localhost in worker.properties as shown below: 

    Example: 

    worker.cfusion.type=ajp13 
    worker.cfusion.host=IP-address-of server 


    Server.xml: Add "address" attribute in connector protocol with IP address as shown below: 

    Example: 

        <Connector protocol="AJP/1.3" port="8020" address="IP-address-of server" redirectPort="8453" secret="xxxx-xxxxxx-xxxxx-xxxx-xxxx" maxThreads="500" connectionTimeout="60000" tomcatAuthentication="false"/> 

    Restart both web server and CF and check if it helps. 

    Thanks,

    Vikram

     

      R
      raspin
      Participant
      June 14, 2022

      Two questions:

      1.

      How come your Update 4 details on https://helpx.adobe.com/coldfusion/kb/coldfusion-2021-updates.html do not include a "Hotfix and packages repository" which your instructions expect - hence the instruction to "Unzip the repository".

      2.

      Have you updated any base installers that include Update 4? Or are we expected to apply the hotfix even if we download the latest installers. If you do have an updated installer (in my case the "Adobe ColdFusion 2021 Windows 64 Bit GUI Installer"), where would I find it?

      R
      raspin
      Participant
      June 28, 2022

      Any chance of a reply from Adobe?

      D
      Community Expert
      Dave WattsCommunity Expert
      Community Expert
      June 28, 2022

      They may have already provided that information in the thread.

       

      Dave Watts, Eidolon LLC 

      Dave Watts, Eidolon LLC
      BKBK
      Community Expert
      BKBKCommunity Expert
      Community Expert
      May 12, 2022

      @Priyank Shrivastava. , could you please clear up one source of confusion. You will find the following on the security page, https://helpx.adobe.com/security/products/coldfusion/apsb22-22.html :

       

       

      On JEE installations, set the following JVM flag, "-Djdk.serialFilter= !org.mozilla.**;!com.sun.syndication.**;!org.apache.commons.beanutils.**", in the respective startup file depending on the type of Application Server being used.   

      For example:   

      Apache Tomcat Application Server: edit JAVA_OPTS in the ‘Catalina.bat/sh’ file   

       

       

      Consider the usual, standalone ColdFusion installation. That is, a ColdFusion installation that is not installed as a JEE web application deployed on a JEE application server such as WebLogic, Tomcat or WildFly. 

       

      The question is, do you have to apply the jdk.serialFilter flag to such a standalone ColdFusion?

       

      Could you please clarify. Confusion arises because a standalone ColdFusion installation still runs on Tomcat, albeit not as a deployed JEE web application. . 

       

      Priyank Shrivastava.
      Community Manager
      Priyank Shrivastava.Community ManagerAuthor
      Community Manager
      May 12, 2022

      @BKBK If you have installed CF as standalone then these flags are not required in jvm.config. These are only for J2EE deployment if you are using WebSphere, WebLogic, Tomcat, JBoss, etc.

       

      I hope this answers your question.

       

      Thanks, Priyank Shrivastava
        BKBK
        Community Expert
        BKBKCommunity Expert
        Community Expert
        May 12, 2022

        Thanks, @Priyank Shrivastava. . Yes, you've answered my question.

        BKBK
        Community Expert
        BKBKCommunity Expert
        Community Expert
        May 11, 2022

        Thanks, @Priyank Shrivastava. and Team.

        At last a Tomcat upgrade to 9.0.60, thereby averting the vulnerability CVE-2021-42340

        Good show!

         

         

        J
        jhansen-cf
        Inspiring
        May 10, 2022

        CF2021u4 seems break Query of Queries (again). I tried adding the hf202100-4212383.jar (a hotfix for a previous update that broke Query of Queries) and that seem to have fixed it. 

        @Priyank Shrivastava. Would you call this a valid solution? Is it too late to add hf202100-4212383 to cf2021u4? 

        Attached you will find some stacktraces. Hope this helps. 

        Please advise...

        Priyank Shrivastava.
        Community Manager
        Priyank Shrivastava.Community ManagerAuthor
        Community Manager
        May 10, 2022

        Hi @jhansen-cf ,

         

        You need to re-apply the patch after you apply the update 4 in your server. This security update does not have any other bug fixes. If you have already applied the QoQ patch and in case that is working. You are good to go.

         

         

        Thanks, Priyank Shrivastava
        jeffh65754959
        jeffh65754959
        Inspiring
        May 10, 2022

        It appears that this hotfix is security related and not feature related.  With CF2018 hotfix 12 we installed hf201800-4212383.jar for the query of queries issue that was introduced with that release.  We had to manually apply it for CF2018  hotfix 13, as well.  I suspect we have to apply it after this CF2018 hotfix 14, as well?

         

        Thanks,

        Jeff

        Priyank Shrivastava.
        Community Manager
        Priyank Shrivastava.Community ManagerAuthor
        Community Manager
        May 10, 2022

        Hi Jeff,

         

        Yes, you have to re-apply that patch. You can find that in the backup directory or you can copy that before you apply the hotfix from \ColdFusion2018\cfusion\lib\updates folder.

         

        Thanks, Priyank Shrivastava
          D
          Community Expert
          Dave WattsCommunity Expert
          Community Expert
          May 11, 2022

          Hi, @Priyank Shrivastava. !

           

          Is this going to be the standard approach for patches in the future? I'm not sure if the QoQ hotfix is intended for everyone or just people running into a given problem.

           

          Dave Watts, Eidolon LLC

          Dave Watts, Eidolon LLC
          Terms & ConditionsAccessibility statement
          Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices