Adobe Coldfusion Update (Security Issue)

[harshp_0559]

Hello CF Community,

I have an application that i am supporting where i need to apply the latest patch to the CF server. Curently we are running 2021 and the servers are patched till update 9. 

My team specifiacally does not have experience with applying the latest patch. So my question is can i install the latest update which is 17 right now directly or do i need to do incremental updates? 

When checking from CF admin on the servers it can not find the latest update when i click on check for updates. so we will be doing it manually. What files are needed for manual installation of the update.

Since we will be doing a manual update can you guys help with any SOPs that might be helpful or list out steps for doing this with info much as possible. Also please let me know if i need to check anything prior.

Thanks in advance.

[AbhishekJha]

@harshp_0559 All the updates are cumulative, so you can install the latest one.

Please see this article for detailed steps: https://coldfusion.adobe.com/2024/09/a-simple-way-to-install-coldfusion-updates-manually-in-offline-...

In case you need help, please send an email to cf.install@adobe.com

Thanks,

Abhishek

[harshp_0559]

Hey Abhishek,

After the update my aplication is throwing the below error:

Cannot find implementation class coldfusion.tagext.mail.MailTag for the mail tag.

struct

ClassName	coldfusion.tagext.mail.MailTag
Column	-1
Detail	[empty string]
KnownColumn	-1
KnownLine	-1
KnownText	<unknown>
Line	-1
Message	Cannot find implementation class coldfusion.tagext.mail.MailTag for the mail tag.

 And the second error is 

The following information is meant for the website developer for debugging purposes.

Error Occurred While Processing Request

Object Instantiation Exception. Class not found: coldfusion.print.PrinterInfo

[harshp_0559]

Also the Collections section on the CF admin does not load any more says the search component is not installed. i checked the packages and its showing under the section with the latest version.

[harshp_0559]

@AbhishekJha  Can you guide for the above?

[BKBK]

Hi @harshp_0559 , the object-instantiation error makes me wonder whether some packages, such as those required for Mail and Print, are missing. I would therefore suggest that you install all the packages. At least, to start with. 

Assuming you are on Windows, you could do the following:

1. Open the Command Prompt (cmd) as Administrator;
2. Use the DOS cd command to navigate to  {CF2021_HOME_DIR}/cfusion/bin;
3. Type cfpm and press ENTER. You should get ColdFusion's package manager prompt cfpm;
4. Run the command install all

5.  Keep running the command install all till the result is either an irreversible error or ColdFusion tells you that "All the packages are already installed".

6. If the former, then share the error message with the forum. If the later, then restart ColdFusion in the usual way, and you're set to go.

[harshp_0559]

@BKBK  Thank you for getting back.

I tried the same as you suggested and got all packages are installed.

As mentioned in https://community.adobe.com/t5/coldfusion-discussions/now-live-adobe-coldfusion-2023-and-2021-june-2... by Charlie i have also checked for the  Jetty/lib/ext but everything is already present in the folder as from the backup folder from the update and the backup i took of the CF folder prior to applying the update.

But even after the restart i see the below in CF admin --> Collections section

and when loading the site i see the below 

struct

Cause

struct ClassName coldfusion.tagext.mail.MailTag Column -1 Detail [empty string] KnownColumn -1 KnownLine -1 KnownText <unknown> Line -1 Message Cannot find implementation class coldfusion.tagext.mail.MailTag for the mail tag.

Below is what is logged in the update log:

Summary
-------

Installation: Successful.

1622 Successes
0 Warnings
0 NonFatalErrors
0 FatalErrors

So i suspect there were no issues with this but below is mentioned in the file:

----------------------------------------------------------------------------------------------------------------------------

The packages repository file:///D:/coldFusion2021/bundles/bundlesdependency.json is not accessible. You can only load the packages that are available locally in the D:\ColdFusion2021\bundles directory.axis (2021.0.11.330247) package and its dependencies have been downloaded successfully.sharepoint (2021.0.11.330247) package and its dependencies have been downloaded successfully.adminapi (2021.0.13.330286) package and its dependencies have been downloaded successfully.administrator (2021.0.17.330334) package and its dependencies have been downloaded successfully.caching (2021.0.17.330334) package and its dependencies have been downloaded successfully.pmtagent (2021.0.17.330334) package and its dependencies have been downloaded successfully.orm (2021.0.17.330334) package and its dependencies have been downloaded successfully.ormsearch (2021.0.17.330334) package and its dependencies have been downloaded successfully.document (2021.0.14.330296) package and its dependencies have been downloaded successfully.report (2021.0.17.330334) package and its dependencies have been downloaded successfully.presentation (2021.0.14.330296) package and its dependencies have been downloaded successfully.image (2021.0.17.330334) package and its dependencies have been downloaded successfully.pdf (2021.0.17.330334) package and its dependencies have been downloaded successfully.print (2021.0.17.330334) package and its dependencies have been downloaded successfully.htmltopdf (2021.0.17.330334) package and its dependencies have been downloaded successfully.ajax (2021.0.13.330286) package and its dependencies have been downloaded successfully.spreadsheet (2021.0.11.330247) package and its dependencies have been downloaded successfully.chart (2021.0.17.330334) package and its dependencies have been downloaded successfully.redissessionstorage (2021.0.17.330334) package and its dependencies have been downloaded successfully.zip (2021.0.17.330334) package and its dependencies have been downloaded successfully.mail (2021.0.17.330334) package and its dependencies have been downloaded successfully.debugger (2021.0.17.330334) package and its dependencies have been downloaded successfully.saml (2021.0.17.330334) package and its dependencies have been downloaded successfully.scheduler (2021.0.17.330334) package and its dependencies have been downloaded successfully.azureblob (2021.0.17.330334) package and its dependencies have been downloaded successfully.awss3 (2021.0.17.330334) package and its dependencies have been downloaded successfully.search (2021.0.17.330334) package and its dependencies have been downloaded successfully.odbc (2021.0.17.330334) package and its dependencies have been downloaded successfully.postgresql (2021.0.17.330334) package and its dependencies have been downloaded successfully.sybase (2021.0.13.330286) package and its dependencies have been downloaded successfully.db2 (2021.0.13.330286) package and its dependencies have been downloaded successfully.sqlserver (2021.0.11.330247) package and its dependencies have been downloaded successfully.mysql (2021.0.13.330286) package and its dependencies have been downloaded successfully.oracle (2021.0.17.330334) package and its dependencies have been downloaded successfully.exchange (2021.0.17.330334) package and its dependencies have been downloaded successfully.websocket (2021.0.17.330334) package and its dependencies have been downloaded successfully.ftp (2021.0.17.330334) package and its dependencies have been downloaded successfully.awsdynamodb (2021.0.11.330247) package and its dependencies have been downloaded successfully.azureservicebus (2021.0.17.330334) package and its dependencies have been downloaded successfully.awssns (2021.0.11.330247) package and its dependencies have been downloaded successfully.awssqs (2021.0.11.330247) package and its dependencies have been downloaded successfully.awslambda (2021.0.17.330334) package and its dependencies have been downloaded successfully.The package and its dependencies have been downloaded successfully. ColdFusion server is currently not running. The package will be installed automatically once server is up.

-------------------------------------------------------------------------------------------------------------------------------------------

I had updated the file based on your comments in https://community.adobe.com/t5/coldfusion-discussions/unable-to-update-from-coldfusion-2021-update-1...

<?xml version="1.0" encoding="UTF-8"?>
<settings><update autocheck="true" checkinterval="10" checkperiodically="false" sendupdate="true">
<url>https://www.adobe.com/go/coldfusion-updates</url>
<defaulturl>https://www.adobe.com/go/coldfusion-updates</defaulturl>
<packagesurl>D:\ColdFusion2021\bundles\bundlesdependency.json</packagesurl>
<defaultpackagesurl>file:///D:/coldFusion2021/bundles/bundlesdependency.json</defaultpackagesurl>
<notification><emaillist/><fromemail/></notification></update><proxy><hostname/><port>0</port><username/><password/></proxy></settings>

[Charlie Arehart]

Harship, a few things:

1) First, as for your current errors (after doing the manual update and installing all packages as bkbk has suggested), the next thing may simply be that you need to delete the felix-cache folder within this CF instance. That is something disucssed in the update technotes for the October CF update: cf2021 update 17, in your case.

The technotes clarify that certain issues will happen if you fail to do that step--which is rarely something we need to bother with. While the things you mention are NOT what the technote says might happen, can you at least please try it?

It's simply a matter of stopping CF, deleting that folder (such as ColdFusion2021\cfusion\bin\felix-cache), then start CF. No need to "save off" the folder. CF will simply recreate it.  Then try what failed and let us know how it goes. 

2) As for the other issues you have raised (from the start and since), I have a few other thoughts:

• As for your updates not being able to be downloaded (in your initial post), it may have been that your Java (the Java that CF is/was pointing to) was outdated, such that the https call from within CF to the Adobe servers failed. But you worked around things by downloading the update. Fair enough. Have you yet updated the Java CF uses? What Java version is reported in use, in your CF Admin "settings summary" page?
• Then you show you changed the neo-updates.xml file (per comments from BKBK you found in a post you pointed to). That link failed. Perhaps you meant this specific comment. That's related more to doing manual updates, especially when CF can't reach the Adobe update server (as discussed in my first bullet).  The packagesurl value you changed relates specifically to the package update process (rather than the "core" update process, updating CF itself).
  • Again, once you update the Java you should be able to do the CF updates within the CF Admin again: and you'll want to correct that xml file to revert back to the original value. Note that the CF Admin even offers a button to restore that default, on that Package Manager page offering the updates, and its "settings" tab at the top of the page.
• You shared your logs showing that the install of that update (the core update) had worked, with 0 fatal errors. That's good. And you showed the bottom of that log, indicating that several packages would next be updated--and good for you in noticing that. But did you catch that it says it would do those updates when CF was next started? The message ends, "ColdFusion server is currently not running. The package will be installed automatically once server is up."
  • If you wanted to understand what happened back then (before you installed all the packages with cfpm as bkbk proposed), it could help for you to look at the CF logs (specifically coldfusion-out.log), at the time of that update log (we don't see that date/time in what you shared above).
    • During that startup of CF, you will see it indicating the uninstall of several packages (those to be updated, and their dependencies).  But are there any errors AFTER that as CF was coming up that day? This isn't important to answer, if the other points above get you going. If nothing else, I leave this for future readers to consider.

[BKBK]

At this point I would also suggest, as does Charlie, that you:

1. delete ColdFusion2021\cfusion\bin\felix-cache, and then
2. restart ColdFusion.

If the errors continue, then that would suggest that the manual process isn't working properly. There is another way.

Do the following (to purge the Felix cache programmatically):

1. Stop ColdFusion.
2. Open the Command Prompt (cmd) as Administrator;
3. Use the DOS cd command to navigate to  {CF2021_HOME_DIR}/cfusion/bin;
4. Type cfpm and press ENTER. You should get ColdFusion's package manager prompt cfpm;
5. Type purgecache and press ENTER. (This runs the command to purge the Felix cache)
6.  Restart ColdFusion.

Is everything OK now?

[harshp_0559]

@BKBK 

I have tried that previously to delete the Felix folder and start the CF services.

i had found this https://community.adobe.com/t5/coldfusion-discussions/cfmail-issue-after-cf2021-update-13/td-p/14983... and redid the steps but did not seem to help

[Charlie Arehart]

Harsh, you've directed to bkbk your response to my point 1 above. Consider also my point 2 above, and the questions I'd asked.

We're here to help, but the answers are not in the detail you've offered so far. 

Also, if you "just want this solved" without all the back and forth, I'll note that sometimes problems like this can be solved more readily by a screenshare session. I offer those on a consulting basis. We might solve this together in as little as 15 minutes, and you won't pay for time you don't find valuable. More at carehart.org/consulting.

But again I've offered all the above and more without obligation, trying to help here. 

[Charlie Arehart]

Just to clarify: doing the cfpm merely does the exact same thing as manually deleting the felix-cache folder. (And it, too, will indicate how it can only be done while cf is down.) It adds no other benefit that I've seen (besides alleviating a need to know just where the folder is). 

[BKBK]

True, manually deleting the Felix cache folder has the same aim as running cfpm purgecache. However, the two methods work differently.

The first is done manually by the developer. on the Operating System. The second is performed programmatically by the ColdFusion Package Manager application. The two scenarios are therefore different. Since there is an issue with packages, of which we don't know the cause, it makes sense to try both ways of purging the Felix cache.

[harshp_0559]

@BKBK 

I have attached the full log of what i see since i applied the update. but closest error i see to felix is below:

Error [main] - Unable to install felixclassloader package: org.apache.http.client.ClientProtocolException: URI does not specify a valid host name: file:///D:/coldFusion2021/bundles/felixclassloader-2021.0.02.328618.jar

In my bundles folder i only see felixclassloader-2021.0.0.323925.jar which i got from the latest files on the Adobe updates page. 

I also checked my Java version which is 11.0.11+9-LTS-194. Should this be updated? we are using the one that ships with CF by default. 

[Dave Watts]

CF is trying to install felixclassloader-2021.0.02.328618.jar but only has felixclassloader-2021.0.0.323925.jar downloaded. So I don't think that's going to work out very well. Here are some things you can do. First, open a bug ticket at https://tracker.adobe.com/. Second, if you need to install felix-cache right now, edit your JSON file to point to the version you have in your bundles folder. I think that should work, although I haven't tried it. You'd have to use a local copy of it of course.

I don't think your version of Java is going to make a difference here. This is just a version mismatch in the JSON file. I'm not sure what's causing the mismatch, but it's not a Java problem.

[Charlie Arehart]

Harshp, I think I see your solution--and thanks for including your coldfusion-out.log, which offers a clue.

First, the java version may have related to your original problem of your not being able to download updates in the Admin. But it is NOT related to the problem you're now facing, regarding packages.

As for that, and regarding the error you observed, "Error [main] - Unable to install felixclassloader package: org.apache.http.client.ClientProtocolException: URI does not specify a valid host name:file:///D:/coldFusion2021/bundles/felixclassloader-2021.0.02.328618.jar", that relates to something you had told us above , where you had changed your neo_updates.xml to include these two lines:

<packagesurl>D:\ColdFusion2021\bundles\bundlesdependency.json</packagesurl>
<defaultpackagesurl>file:///D:/coldFusion2021/bundles/bundlesdependency.json</defaultpackagesurl>

Notice how the first part of that second line matches your error precisely: "file:///D:/coldFusion2021/bundles". And one might propose you change that the value in your neo_updates.xml file...

But as I review the rest of your coldfusion-out log, I see that specific error occurred only until your Dec 18, 2024  at 05:24:36 AM. After that, your next CF restart a few hours later shows a DIFFERENT variation of that error:

Dec 18, 2024 09:12:15 AM Error [main] - Unable to install felixclassloader package: java.lang.IllegalArgumentException: Illegal character in opaque part at index 2: D:\ColdFusion2021\bundles/felixclassloader-2021.0.02.328618.jar

That suggests you DID change it, during those few hours. So please tell us now: what ARE the current values for those two lines?

I appreciate that you've been pulled into this mess by the original challenge you had about not being able to pull down the latest CF updates in the CF Admin (which I've said more than once is related to Java). But in "solving" that problem you instead did a manual CF update (as discussed in the CF update technotes and other forum threads you pointed to).

It's very easy for all this to get messed up. There are many variables involved.

Now that you have (it seems) applied the update manually, did you do the step of extracting the zip offered in the update technotes? Did you put it in the d:\coldfusion2021\bundles folder? If so, then is that felixclassloader-2021.0.02.328618.jar there? If not, where is it? Where DID you extract that zip?

The "url" values above can either be a path for the bundlesdependency.json file (and the jar files alongside it) or a URL that RETURNS such a bundlesdependency.json file. FWIW, the ORIGINAL value for both of those lines (for CF2021) in that XML file (about packages) is  https://www.adobe.com/go/coldfusion-packages.

Once you change things, you could try doing the package uninstall/installs either in the Admin or via CFPM, without need of a CF restart. There's more I could share, but let's see where this gets you.

Let us know if that helps.

[harshp_0559]

@Charlie Arehart 

The neo-update file has not been updated since i started the update process.  Yes as for the manual process it required the hotfix-packages-cf2021-017-330334.zip file to be downloaded and i pasted the content of it into the bundles folder. I also thought the same thing regarding the felix class and downloaded a fresh copy of the zip file from the adobe site and only see the 2021.0.0 version in that file. 

[Charlie Arehart]

Ok if you didn't change it "since" starting the update process, then you or someone changed it before. What you showed is NOT the default. I gave you that. Please reset the value, restart cf, and let us know how that goes. 

[Priyank Shrivastava.]

@harshp_0559  If it is not resolving the issue, can you please contact cfsup@adobe.com . 

My team will help you. 

[BKBK · Accepted solution]

@harshp_0559 ,

Are you looking for a possible solution to the problem of packages not being installed on ColdFusion 2021? Then read on.

It would be handy to update Java to the most recent version, namely, Java SE 11.0.22 (LTS). But I think that this can wait till later. I say this because I think the Java version is not the cause of the current problems.

I think @Dave Watts puts his finger on the root cause. Namely, your ColdFusion 2021 installation does not have access to the current packages, such as felixclassloader-2021.0.02.328618.jar.

There is a possible source of confusion, which can cause such issues: the URL https://www.adobe.com/go/coldfusion-updates. ColdFusion 2021 uses this URL in neo_updates.xml and in other settings. The trouble is, ColdFusion has since been upgraded to ColdFusion 2023, and ColdFusion 2023 uses the same URL Hence using the URL on ColdFusion 2021 will cause a mix-up.

In any case, there is one way to correct the packages issue. It consists of downloading all the current ColdFusion 2021 packages yourself. To do so, proceed as follows:

1.  Stop ColdFusion.
2.  Delete the Felix cache using either of the two ways previously described in this thread.
3.  Check to make sure the directory D:/ColdFusion2021/bundles/ exists. If it does, then back it up by moving it, with all its contents intact, to a location outside ColdFusion. Then ensure that D:/ColdFusion2021/bundles/ is empty.
   
   If the directory doesn't exist to start with, then that is already an issue. In that case, create the directory.
   
4.  Check the firewall rules and ensure that ColdFusion has full access to D:/ColdFusion2021/bundles/.
5.  Open the Command Prompt (cmd) as Administrator;
6.  Use the DOS cd command to navigate to  {CF2021_HOME_DIR}/cfusion/bin;
7.  Type cfpm and press ENTER. You should get ColdFusion's package manager prompt cfpm;
8.  Now use the downloadrepo command to download the packages repository. To do so, type downloadrepo D:\ColdFusion2021\bundles and press ENTER. It may take up to half an hour for the download to complete. So be patient. The cfpm cursor will reappear when the download is complete.
9.  Verify that the directory D:/ColdFusion2021/bundles indeed contains the downloaded packages.
10.  Edit /lib/neo-updates.xml and make sure it contains the following:

<packagesurl>file:///D:/ColdFusion2021/bundles/bundlesdependency.json</packagesurl>
<defaultpackagesurl>file:///D:/ColdFusion2021/bundles/bundlesdependency.json</defaultpackagesurl>

11.  Restart ColdFusion 2021.
12.  Check whether ColdFusion 2021 now works as expected.

[harshp_0559]

@BKBK Thank you for those steps. It worked and now all the sections are seeing hte packages installed.

But CF is still throwing the below warnings.  from looking at the log the Unable to determine dialect of the StAX implementation warning started after i applied the udpate.

Dec 23, 2024 10:37:51 AM Information [main] - ColdFusion started
Dec 23, 2024 10:37:51 AM Information [main] - ColdFusion: application services are now available
Dec 23, 2024 10:37:52 WARN [main] - Unable to determine dialect of the StAX implementation at jar:file:/D:/ColdFusion2021/cfusion/lib/bundleaxis/wstx-asl-3.2.9.jar!/
Dec 23, 2024 10:37:52 AM Warning [main] - Unable to determine dialect of the StAX implementation at jar:file:/D:/ColdFusion2021/cfusion/lib/bundleaxis/wstx-asl-3.2.9.jar!/
Dec 23, 2024 10:37:55 AM Information [Thread-16] - PDFg service manager http://127.0.0.1:8993/PDFgServlet/ registered.
Dec 23, 2024 10:38:01 AM Information [Timer-0] - An error has occurred while sending usage data to server.

[Charlie Arehart]

Harsh, a couple of things. First, glad you feel things are resolved now.

Second, as for those remaining "stax" errors, sadly those are normal and happen to everyone running cf. I've complained of them to Adobe before, but for now they remain. FWIW, someone else filed a bug report about it, and you and other interested folks could add a vote there: https://tracker.adobe.com/#/view/CF-4221319

Third, as for your resolution, I really do suspect it was step 10 of BKBK's which solved things. It's what I'd been saying from the beginning (granted, the URL I propose you use is Adobe's recommended value, and it leads to a redirect that points to that same folder he had you point to.) Either should have worked, and for reasons I tried to relay in the previous messages. I don't press this to "prove I'm right" (nor to suggest bkbk was wrong), but just to help anyone else finding this in the future to be able to connect the dots (assuming I am). But I realize you may simply "move on" with things now that they work.  Glad you can now do that.

[BKBK]

@harshp_0559 , I am glad to hear that the packages can now be installed. 

You may ignore the warning, " Unable to determine dialect of the StAX implementation at...". I explain why in a previous thread on the STAX warning.

[forrestmahannah]

I am trying to download the repository per BKBK but I notice a lot of read timed out messages while it is downloading. Is this something normal or not? Thanks

[BKBK]

Hi @forrestmahannah , Yes, it is normal to see read time-outs during the download process. The repository usually renews and updates its contents.