NOW LIVE! Adobe ColdFusion 2023 and 2021 October 2024 updates

[Saurav_Ghosh]

We are pleased to announce that we have released general updates to ColdFusion (2023 release) Update 11 and ColdFusion (2021 release) Update 17. 

The updates include bug fixes and enhancements in Administrator, Language, CFSetup, Database, and other areas. They also contain library upgrades, such as netty, ehcache, etc.

After applying the update, we recommend clearing the Felix cache as a workaround for installing the HTMLToPDF package and verifying the Oracle data source.

The updates also contain enhancements to whitespace management and client variable support in CFPM.

Where do I download the updates from

Download the updates from the following locations:

• ColdFusion (2023 release) Updates
• ColdFusion (2021 release) Updates

For more information, view the following tech notes:

• ColdFusion (2023 release) Update 11
• ColdFusion (2021 release) Update 17

Known issues in the update

• The PDF Services page in ColdFusion Administrator does not load even with the HTMLToPDF package installed. As a workaround, follow the steps:
  • Uninstall the HTMLToPDF package.
  • Stop ColdFusion.
  • Clear the Felix cache (<cf_home>/cfusion/bin/felix-cache).
  • Restart ColdFusion.
  • Install the HTMLToPDF package.
• After installing the latest update, the Oracle DataSource verification fails. To work around this, clear the Felix cache and restart ColdFusion.
• An exception occurs when indexing Open Document Format files, such as those with a .odt extension.

Are the Docker images available

The images are available on the Docker hub and ECR.

Is CFFiddle updated with the changes

CFFiddle is updated with the changes.

Please update your ColdFusion versions and provide your valuable feedback.

[xfreeman89x]

The update break the server. I tried to install it also manually but nothing to do.
This is what I see from the logs: 

javax.servlet.ServletException: ROOT CAUSE: 
coldfusion.server.ServiceFactory$ServiceNotAvailableException: The ClientScope service is not available.
    at coldfusion.server.ServiceFactory.getClientScopeService(ServiceFactory.java:702)
    at coldfusion.filter.ClientScopePersistenceFilter.invoke(ClientScopePersistenceFilter.java:32)
    at coldfusion.filter.BrowserFilter.invoke(BrowserFilter.java:38)
    at coldfusion.filter.NoCacheFilter.invoke(NoCacheFilter.java:60)
    at coldfusion.filter.GlobalsFilter.invoke(GlobalsFilter.java:38)
    at coldfusion.filter.DatasourceFilter.invoke(DatasourceFilter.java:22)
    at coldfusion.filter.CachingFilter.invoke(CachingFilter.java:62)

Do I miss something?

[Charlie Arehart]

While you await a reply from Adobe, I'll report that I did not get that error in applying the update. You could help us help you by answering a few questions:

1. Was this cf2023 or 2021?
2. What update were you on before this?
3. What OS?
4. Are you saying cf now won't start?
5. Is there perhaps more info in the cf logs, before that one, during startup?
6. Have you tried uninstalling the update?

Even if you "can't access the cf admin to do that", note that you can do it from the command line--like the manual install you attempted.  See the cfusion/hf-updates folder whose name includes the number of the update you did. That has an uninstall folder in it, and that has an uninstall .bat or .sh to run.

Or again, perhaps Adobe or someone else may chime in with news that they've seen this before and/or have different info to suggest.

[megha1997]

Hi @xfreeman89x  Could you please share your hotfix installation log file?

[xfreeman89x]

Here the installation log file. There are several fatal errors but I can't undestand if they can cause the error I mentioned before.

[megha1997]

@xfreeman89x Thanks for sharing the log file. I have couple of questions:

1.  Did you run the hotfix manually? If yes, then was it run with administrator privileges?
2.  What is the JDK version you are using to run CF and the hotfix jar?

[xfreeman89x]

1) I tried both: automatically and manually. But same error occurs. The only difference I see is that running the update manually clear the fatal errors in the log. In this case I have only this warning: 
WARNING - Source file C:\Users\Admin\592154.tmp\dist\cfusion\lib\cfusion-req-cloud.jar does not exist.
2) I'm using the JDK 17.0.12 (also tried 17.0.11)

[megha1997]

@xfreeman89x Did you use this flag while installing the hotfix - 

-Djdk.util.zip.disableZip64ExtraFieldValidation=true

Could you please attach the new log file (where you mentioned there were no fatal errors)?

In the ColdFusion Administrator, click the "i" button in the top right corner under Server Details. Please check the Version and share that information here as well.

[xfreeman89x]

Yes, I used the flag

-Djdk.util.zip.disableZip64ExtraFieldValidation=true

for manual installation.

Here the new log file and the screen for the server details. Unfortunatelly I cannot get the information you want after the installation because also the CF Administrator is broken. I had to revert the update.
Every time I apply the update I get this error on all the pages (administrator, websites, ecc)

javax.servlet.ServletException: ROOT CAUSE: 
coldfusion.server.ServiceFactory$ServiceNotAvailableException: The ClientScope service is not available.
    at coldfusion.server.ServiceFactory.getClientScopeService(ServiceFactory.java:702)
    at coldfusion.filter.ClientScopePersistenceFilter.invoke(ClientScopePersistenceFilter.java:32)
    at coldfusion.filter.BrowserFilter.invoke(BrowserFilter.java:38)
    at coldfusion.filter.NoCacheFilter.invoke(NoCacheFilter.java:60)
    at coldfusion.filter.GlobalsFilter.invoke(GlobalsFilter.java:38)
    at coldfusion.filter.DatasourceFilter.invoke(DatasourceFilter.java:22)
    at coldfusion.filter.CachingFilter.invoke(CachingFilter.java:62)

So, the version actually installed after the revert is 2023.0.10.330680.

[megha1997]

@xfreeman89x Thanks for sharing the info.

We are currently unable to reproduce this issue at our end. If there is any specific step or any more information regarding your setup that you could share, it would help us to reproduce the issue

[xfreeman89x]

The server is hosted on AWS and it is powered by Coalesce Solutions. I don't know if this information can be helpful.

[megha1997]

Hi @xfreeman89x 

If this issue still persists, please contact cfsup@adobe.com

[xfreeman89x]

Unfortunatelly, the issue is still there

[Charlie Arehart]

Freeman, while you may await further direct help from Adobe support folks, if you look at the coldfusion-out.log and especially the first startup after that update to 11, I suspect you'll find the explanation for both the admin not working and the "ClientScope service is not available" error. If you would share just the errors within that, we may see something if you don't. Same if there are errors after the uninstall. 

[xfreeman89x]

Hi Charlie, hi all,
in the past few days I wrote to cfinstall and they helped me to resolve the issue.
It seems that the update 11 is not compatible with installations on AWS Marketplace, so they provided me the hotfix hf202300-4224138 that is still under testing phase.
Applying this hotfix solved my problem with update 11.

[DevScreen]

Reply removed.

[xfreeman89x]

Hi Charlie,

here the answers to your questions point by point:
1) cf2023
2) update 10 before this
3) Windows Server 2022
4) CF start normally but every page and also the administrator has 500 error
5) I have this error in server.log "Error","Thread-18","10/16/24","13:00:18","","The ClientScope service is not available. This exception is usually caused by service startup failure. Check your server configuration." and this error in application.log: "Error","http-nio-8501-exec-3","10/16/24","13:00:05","","Could not initialize class coldfusion.runtime.AppHelper The specific sequence of files included or processed is: C:\ColdFusion2023\cfusion\wwwroot\CFIDE\administrator\index.cfm, line: 24"
6) uninstalling the update makes ColdFusion server working again

Yes, I had to uninstall the update by command line.

[Charlie Arehart]

Thanks. First, glad you were able to recover with the uninstall. Second, as for point 5, that's the same info you'd offered before. I asked if there was OTHER info--before that.

But now I'd turn our attention to what info you see also in the update log. That, too, is in the hf-updates folder for the update you applied. I suspect you had errors DURING the install of the update. There can be many causes of that. I discuss it more in a blog post of some years ago, still relevant (How to solve common problems with applying ColdFusion updates), but I don't know if it will be necessary for you to read it. 

One key point I make there, and another question for you: when you applied the update manually, did you use "run as admin" when opening the command line?

Finally, there's one more question I should have asked: what Java version does your cf admin now show that you have running under cf? (Don't judge from the command line. That could be different from what cf uses. See the "settings summary" page in the admin, which is the last link at the top of the "server settings" section. Then see about 10 lines down.) 

Since you're on cf2023, it should be some Java 17. But (since applying the update 10 you're on) did you perhaps change the jvm cf uses to use Java 17.0.8 or later? If so, you may be hitting an issue I discuss in a blog post from a year ago (this week, in fact)

https://www.carehart.org/blog/2023/10/10/solving_problems_applying_latest_cf_updates

The tldr at the top of the post maybe all you need. In fact Adobe mentions it in the technotes for yesterday's update: you may need to add another jvm arg to the manual command line update you did. You'd want to add:

-Djdk.util.zip.disableZip64ExtraFieldValidation=true

on the "java -jar " command, with that placed BEFORE the -jar arg). 

I elaborate in the post on HOW to do it if the technote's suggestion isn't enough. I also mention this in my own blog post from last night about yesterday's update, FWIW:

https://www.carehart.org/blog/2024/10/16/ColdFusion_updates_released_Oct_15_2024

Let us know if any of this gets you going.

I'll add that as I also mention in those posts, I can certainly help folks directly, via remote screenshare, often solving such things quite quickly (consider how readily all this info on share comes to mind for me). Of course, different people have different problems. I try in these online resources to guide you based on what info you offer. I also write to benefit ANYONE who may be following along. In a session together, we'd obviously be targeted to your specific needs and what you know/don't know. More at carehart.org/consulting.

But I hope I've given you (and others here) enough to hopefully get you going on your own. 

[Hildebrand Soethoudt]

Hmm. Same here. To answer Charlie's questions:

• yes, update install command was run from elevated CMD prompt
• update was installed using cfusion JRE
• yes, JRE version is 17.0.9 so > 17.0.8
• update install log is pretty much clean and all successful
• there's no mention of ZipException in the update install log

Then, the symptoms:

• all applications AND ColdFusion administrator UI are broken
• there are exceptions in the logs mentioning "Could not process Application.cfc successfully for template <...>"
• Caused by 'Could not initialize class coldfusion.runtime.AppHelper' at coldfusion.runtime.AppEventInvoker.getAppThisDefaults(AppEventInvoker.java:43) at coldfusion.filter.PathFilter.resolveApplicationScope(PathFilter.java:213)
• Caused by: java.lang.ExceptionInInitializerError at coldfusion.server.ServiceFactory.getClientScopeService

We'll be retrying at a later point. Any suggestions are welcome. I suspecting the introduction of the 'Clientvariable support in CFSetup' might have anything to do with it, but that's just guessing.

[Legorol]

The MD5 checksums are wrong for ColdFusion 2023 update 11, as of 21 Oct 2024.

• hotfix-packages-cf2023-011-330706.zip downloaded just now (several times) has MD5 2b4c02eb54d4e241f582b3349dfbfd5e
• https://helpx.adobe.com/coldfusion/kb/coldfusion-2023-updates.html (US page) shows:
  Hotfix and packages repository: Link (MD5: 0b54bddb19880cba1980450394ddd5cf)
• https://helpx.adobe.com/uk/coldfusion/kb/coldfusion-2023-updates.html (UK page) shows
  Hotfix and packages repository: Link (MD5: 4c02eb54d4e241f582b3349dfbfd5e)

This is very concerning, I had to point out incorrect MD5s last time as well. Not only is the MD5 of the actual download not matching what's state on the page, why are the two localisations showing different checkums?

[Priyank Shrivastava.]

@Legorol  We have corrected this for the North America instance however, proper sync didn't happen for other regions. We have refreshed again and it will be fixed soon.

[Legorol]

@Priyank Shrivastava. thanks for responding. Unfortunately I'm confused by your reply. Differences in localisation  (UK) aside, the main problem is that the checksum on the US page doesn't match the file itself.

To reitarte, when I download hotfix-packages-cf2023-011-330706.zip from https://cfdownload.adobe.com/pub/adobe/coldfusion/2023/packages/hotfix-packages-cf2023-011-330706.zi..., its MD5 is 2b4c02eb54d4e241f582b3349dfbfd5e.

However, the US page (https://helpx.adobe.com/coldfusion/kb/coldfusion-2023-updates.html) shows an MD5 of 0b54bddb19880cba1980450394ddd5cf.

This doesn't seem to be fixed.

[Priyank Shrivastava.]

@Legorol  apologies that I was not clear. We have regional instances for documentation. When we push the update documentation, we have to push the other region documentation as well. It is usually available quickly however, there is a sync issue, and couldn't update the document for the UK. We are still working with internal IT to get this fixed. 

In the meantime, you can take the reference https://helpx.adobe.com/coldfusion/kb/coldfusion-2023-updates.html for this article and use the link to download the installer.  

This is the correct one which is referenced in this screenshot. 

[Legorol]

@Priyank Shrivastava. I understand about the UK page, we can forget about that, that is not my problem anymore.

What I am saying is there is a problem with the file itself as well. Your screenshot (and the US page) shows a checksum of 0b54bddb19880cba1980450394ddd5cf, but the file download does not match that! I have tried downloading multiple times now, and every time I download it hotfix-packages-cf2023-011-330706.zip has an MD5 checksum of 2b4c02eb54d4e241f582b3349dfbfd5e!

[Priyank Shrivastava.]

Let me try, please allow me sometime to check this and get back here.