ColdFusion 2016 Supported JVM and Tomcat

[KennethMHutch]

I need to know the latest version of JVM and Tomcat for Cold Fusion 2016 

Currently I am using JVM: 11.0.6+8-LTS looking at upgrading to JVM 11.0.7

As well as upgrading from Tomcat 8.5.42 to Tomcat 8.5.55 

[Charlie Arehart]

You can alway update to the latest JVM subversion of the major version that your CF instance supports. With CF2016, yes, you can therefore update to 11.0.7 (as long as you are on update 8 or later). I discuss this in more detail here (including an update on the current state of CF support of Java 12 and above).

As for Tomcat, you CANNOT upgrade the version of Tomcat that CF embeds, assuming you are deploying CF the "normal" way where you have a CF folder and coldfusion process, which is known as the Server form of deployment. (If you have implemented Tomcat yourself, and implemented the CF JEE form of deployment, via a war or ear file, then you CAN update Tomcat yourself.) The Tomcat that underlies the "server" form of CF can only be upgraded by Adobe.

And for now, CF2016 implements Tomcat 8.5.42 as of CF2016 update 12 (https://helpx.adobe.com/coldfusion/kb/coldfusion-2016-update-12.html).

And yes, Adobe and others are aware that that means we are behind, and that later versions of Tomcat include important security fixes. We can only wait for Adobe to update Tomcat. (FWIW, CF2016 update 14 from Sep 2019 DID update the aspects of Tomcat related to fixing the "ghostcat" vulnerability.) And in case anyone may ask, CF2018 runs instead on Tomcat 9, and was updated to 9.0.21 as of its update 5, also from Sep 2019. And its update 8 addressed the ghostcat issue.)

[KennethMHutch]

Hi Charlie thanks for the update. 

I talked it over with my team and we are intrested in upgrading to CF 2018. Can you point me to any blog post you have related to the upgrade?

[Charlie Arehart]

It's interesing, now that you mention it. I don't know that I've ever done a post specifically on upgrading CF from one version to the next. I have mentioned it in various posts, and addressed issues in many forum posts here. I just have never written up a post. And honesly, I'm not aware of any that anyone else has done.

Partly, that's because technically there's the question of "upgrading CF" and then there's the question of "testing your app against the new CF". Many people would do the latter on some separate machine (installing the new CF there, setting up their Admin, moving their code there and testing it). Then they'd do a DNS change to have the site run on the new server. (One can do a LOT more in such a move, or do things differently, of course.)

As for "upgrading CF", another thing to note is that the CF installer does not "upgrade" one CF version to another. You just install the new version, alongside the old one. In doing that, on the first launch of the Admin, it will offer to import CF Admin settings from the old to the new.

There are still more things one can do to migrate settings from the old to the new. And in fact I plan to cover that in an upcoming presentation on the Online ColdFusion Meetup (after I do one this week on updating CF, which is not about upgrading from one version to another but about applying updates to your current CF version).

Then finally, there is the matter of dealing with compabibility issues, in trying to upgrade from one version to another.

Now that you have asked, I do think I might create now a 3rd upcoming session on this broader topic of upgrading from one CF version to another, to cover all the above (well, leaving some details covered in the previous sessions).

Until then, hope the above helps. And if you are pressed to do it sooner, I will note that there are folks who can help you in such a migration. Some are consulting companies who will take it all on, while others (like myself) instead focus only on helping you to do it yourself, pointing out solutions to problems as they arise (via remote screenshare), and leaving you to attend to them until you may hit another snag.

I list both types of consulting companies as a category of my CF411.com site of tools and resources for CFers. The development companies are at https://cf411.com/cfappdev, and the troubleshooting consultants (like myself) are at https://cf411.com/cftrouble.

Or of course, you can ask here and get the benefit of all those who read these (but create a new forum thread for new topics).

[Dezran2000]

Sorry to dig up an older thread, but I'm running into an issue with Tomcat 8.5.42 still being the CF integrated version, and this is the most relevant thread I've been able to find.

We are going to have to update to a version of Tomcat >= 8.5.60 in our CF installation in order to meet security standards.

Is there still no way to update Tomcat until Adobe releases a formal update?

[Dezran2000]

Left out that we have CF 2016

[Dave Watts]

No, you can't just change the version of Tomcat used by the integrated CF install. My understanding is that this is because CF changes quite a bit of internal Tomcat functionality, so this is no easy effort for Adobe to make. Adobe generally does release patches specifically to address Tomcat vulnerabilities, though, so read through the list of patches to see if your vulnerability is addressed even if the overall version of Tomcat is not moved to the next version.

I note that CF 2018 uses Tomcat 9, so you could simply upgrade to that. I'd strongly consider upgrading CF to 2018 or 2020.

Finally, you can use the Enterprise version of CF to deploy to various J2EE application servers. I expect Tomcat is one of those supported, but you should really be able to use any of them. Of course, this means that you'll have to purchase the Enterprise license, and your features will be a bit different from the "integrated" option.

Dave Watts, Eidolon LLC

[Dezran2000]

Thanks for the answer Dave. 

I've done a lot of digging on Google over the last couple of days, and after finding this thread, I just wanted to confirm I was understanding correctly.

I'm going to bring up the upgrade as a possible option, but it may not fix the issue. 

I haven't been able to find anything concrete that confirms what version of Tomcat is embedded in the most recent update for either version, but what I have found looks like we may still be a version shy of our new requirements.

[Dave Watts]

I think you can view the version of Tomcat from the info page in the CF Administrator.

Dave Watts, Eidolon LLC