Community Manager

Question

NOW LIVE! Adobe ColdFusion 2023 and 2021 October updates

Forum|Forum|2 years ago
October 6, 2023
10 replies
9559 views

Document update history:

10/10/2023: Added Docker Hub and ECR locations.
10/10/2023: Refreshed the Server ZIP and GUI installers, Lockdown installer, and Add-on installer for ColdFusion (2023 release). Head over to ColdFusion downloads to download the installers.

We are pleased to announce the availability of ColdFusion (2023 release) Update 5 and ColdFusion (2021 release) Update 11 today!

Where do I download the updates from

What's new and changed in the updates

Both the updates include bug fixes and enhancements in Administrator, Installer, Migration, Package manager, Database, and other areas. The update contains upgrades to Tomcat (v9.0.78) and other libraries, such as jackson-databind, Netty, etc. Note that this update is cumulative and includes fixes from the previous updates.

The updates include package install enhancements, Admin APIs for activation requests, new attributes for Exchange tags, connector-related enhancements, and many more. Check out the tech notes for more details.

Do I need to recreate the connector after installing the updates

Yes

Do these updates contain updated packages

Yes

Are the Docker images available

The images are available on the Docker hub and ECR.

Please install the updates and let us know your feedback.

This topic has been closed for replies.

T

Tim2842955474bi

Participating Frequently

Well, unfortunately one of the long-due "bug fixes" now changes behavior significantly. https://tracker.adobe.com/#/view/CF-4217130

When we moved to CF2021 we had to update a lot of code related to this "bug" which makes struct keys case sensitive. Now they have switched it back to upper-casing all struct keys, which breaks a lot of code that will be hard to find prior to release (especially where Javascript is involved with JSON data returned with these struct keys).

As the case-sensitive struct keys have been something everyone has had to work with for the almost 2 years since CF2021 was released, Adobe needs to provide a solution to keep them case-senstive. We can't take update 11 or any more hotfixes into production until this is resolved. This is a huge lift to find, update and test that code.

ucsbaait

Participant

I applied CF2021 Update 11 on the first of our 5 servers a couple of days ago.

As I've noted before, for some reason we cannot use CF Administrator itself to download and install the updates. CF Administrator knows the update is available (and emails us about it), but the updates simply never download when we try to initiate the download. (And we've confirmed we can access the XML file, the actual update package, etc. from the server itself.)

So we use the manual process to install the update. I'd like to check/confirm a few things about that:

1) We're running java.exe -jar ....jar using the java.exe that came with ColdFusion 2021 (cf_root\jre\bin\java.ese).

This means we do not need to worry about the extra Zip64 flag, right?

2) For updates that require updating or recreating the connector as well as updating packages, does it matter which order we do that in?

Can we install the core update, then update or recreate the connecotr, then update the packages? Or do we have to update the packages before updating or recreating the connector?

3) After installing this update, I had to manually reinstall ColdFusion Adminsitrator itself. Is this normal for Update 11?

Would this also be required if we were able to use ColdFusion Administrator itself to download and install the updates, as intended?

4) In order to install the new version of ColdFusion Administrator, I used the command line package manager (cfpm.bat) and ran "install adminsitrator". When I had the packages URL set to the default Adobe repository, this worked fine. It downloaded the package and installed it. (So I'm further puzzled as to why I can't get updates done through CF Administrator.)

However, when I had downloaded the packages locally and pointed the packages URL (in neo_updates.xml) to the location where they were stored on the server, the package manager just said the location was unavailable.

Do package updates done locally have to be done from an actual web URL (vs. a local path on C:\...)?

Related, the instructions for manual installation reference <InstallerReposityUnzippedPath>/bundles/bundlesdependency.json. But I don't see /bundles/ as a folder within hotfix-packages-cf2021-011-330247. bundlesdependency.json is at the root level of hotfix-packages-cf2021-011-330247. Is that just an error in the documentation? Or does bundlesdependency.json (or anythign else) actually need to be in a subfolder named /bundles/ ?

5) In order to update the other pakcages, I tried doing that through the ColdFusion Administrator, but it didn't indicate that anything needed an update. Using cfpm.bat and running "update packages" resulted in it saying that everything was up to date (when it wasn't). I then tried "install all" and that downloaded and installed the latest package version for everything that needed updating.

This server already has all packages installed, but I'd obviously rather not have to "install all" to get updates just for the packages I need, and I'd rather not have to manually call "install <packagename>" for every package that we already have installed jsut to get them updated.

Any ideas what might be causing this?

Thanks

Charlie Arehart

Community Expert

The answer to 1 is yes. Check out my blog post referenced on previous comments if you'd like more info.

As for 2, there's no connection between the package process and the web server connector. Order doesn't matter.

As for 3 and beyond, does your machine running cf have internet access? Your issues seem to be of the sort when it does not.

And in that case, the info at the bottom of the update technote is focused on that.

And to point 4's bundlesdependency.json, that's referring to the location where you would extract the zip referred to in that offline install process of the update technotes (which is not new but has been so for most updates, since cf2021 update 2, iirc.)

After assessing things, let us know what questions remain. (And if you just want it "done", I can help on a remote consulting basis in as little as 15 mins, with satisfaction guaranteed. Or perhaps Adobe or someone else will offer remote help for free.)

/Charlie (troubleshooter, carehart. org)

B

bw_bloodletter

Inspiring

(I accidentally posted the previous post with a different functional account we use to manage Adobe software subscriptions.)

Thanks for confirming 1 & 2.

For 3-5, yes, the machines all have internet access and can fetch the metadata at the default Adobe URL just fine. And the command line package manager can grab the actual files from the Adobe repo just fine. On the first machine I upgraded, cfpm.bat couldn't detect that updates were needed (update packages said they were all updated), but issuing the command to just install them resulted in the latest version being fetched and installed successfully.

On 3 other servers I did the update on several days later, just running java.exe -jar and pointing to the hotfix.jar we extracted from the offline installer zip resulted in all packages being updated automatically.

So now I'm wondering if this is just a web caching issue with the repo, as others have reported.

Regarding the point about bundlesdependency.json, the question I have is about the /bundles/ subfolder. The instructions reference <InstallerReposityUnzippedPath>/bundles/bundlesdependency.json.

But /bundles/ doesn't exist. bundlesdependency.json is just at the root level in the zip file, along with a bunch of jars and zips, such as administrator-2021.0.11.330247.jar and administrator-2021.0.11.330247.zip.

I'm curious if that matters or if the instructions just need to be updated to remove the reference to /bundles/ as the ZIPs aren't packaged with that structure. I'm not sure if/when they were packaged with /buncles/ as a subfolder in the past.

P

Paolo O.

Participant

Hi,

on my Enterprise server with more instance with CF2023+hotfix4 i have updated with hotfix5, i get this issue:

HTTP Status 500 – Internal Server Error

Type Exception Report

Message java.lang.NullPointerException: Cannot invoke "coldfusion.server.LicenseService.isStandard()" because the return value of "coldfusion.server.ServiceFactory.getLicenseService()" is null

Description The server encountered an unexpected condition that prevented it from fulfilling the request.

Exception

javax.servlet.ServletException: java.lang.NullPointerException: Cannot invoke "coldfusion.server.LicenseService.isStandard()" because the return value of "coldfusion.server.ServiceFactory.getLicenseService()" is null

after which I can't do anything anymore, not even uninstall with jar, just manually deleting or recreating the instance.

what am I doing? do I have to start creating the whole environment again?

Charlie Arehart

Community Expert

While you await word from Adobe (if they may recognize this as some new problem), and before you may start over from scratch, consider first checking the update log, as there may have been an error there, which could lead to odd errors later.

Did you update cf before or after creating the instance? If after, did you do it from the admin of the cfusion instance or the admin of the new instance. That will inform WHERE to look for the update log, in the hf-updates folder under the admin where you ran the update. Then there's a folder corresponding to the number of the update you applied, and in that folder is an install log with a very long name and the datetime you ran the update. Look about 70 lines down that log for a table counting successes and errors. Were there any errors?

/Charlie (troubleshooter, carehart. org)

Paolo Olocco

Participating Frequently

Hi Charlie,

now I updated hotfix5 (cf2023) from the instance and it worked. Thanks!

An issue remains on the "report" package: when I start from scratch from a new server cf2023.0.0.330468 and try to install that package I can't because it always requires a dependency with cf2023.0.0.330469 (which doesn't exist)

BKBK

Community Expert

Thanks, @Saurav_Ghosh and Team.

Charlie Arehart

Community Expert

Saurav, can you correct the reference to the Java version at the top of the technote for cf2021? It refers to Java 17.0.8 (like the cf2023 one does). But currently cf2021 supports only Java 11, so it should say Java 11.0.20, as that's the equivalent to 17.0.8--both new as of July, which introduced the need of the special jvm arg.

While you're at it the wording should say "or greater", for both Java versions, because a new jvm update is due this month and it will almost certainly carry forward this issue.

Finally, note how the cf2023 technote uses a box to highlight this issue discussed at the top while the cf2021 technote does not. A casual reader could miss that (as just a paragraph within the what's new section.)

There are some other inconsistencies about the two technotes, and I'll report that tomorrow if they remain by then.

/Charlie (troubleshooter, carehart. org)

S

Saurav_Ghosh

Author

Community Manager

Thank you Charlie. I've made the changes.

Charlie Arehart

Community Expert

Thanks, Saurav. You'll want to modify the post to point out how the Docker/container images are indeed now available at both dockerhub and ECR (since you mentioned that at the end of the post).

/Charlie (troubleshooter, carehart. org)

davequested

Participating Frequently

Update not appearing in CF2023 Administrator, only shows up to update 4.

Charlie Arehart

Community Expert

Dave, this has happened with the earlier updates: in nearly all such cases, it was a caching issue. Not a BROWSER caching issue you can influence, but instead some caching between your machine (running cf) and the Adobe server(s) offering the updates. And it's about the xml feed used to offer these updates.

You may find that within hours, suddenly the update appears. There's also that "check for updates" button on the admin updates page which you can click to try in hours to come.

Finally, note that the technote offers a link for you to manually download the update (jar file) and offers instructions for applying it manually near the bottom of the technotes.

You may need to do that anyway with this update (the manual install)--if you have cf set to use Java 17.0.8 or greater for cf2023, or Java 11.0.20 for cf2021. In those cases, running the update in the admin will fail. Instead, we need to do the manual install of the update and add a new jvm arg--as mentioned at the TOP of each technote (in a box on only one of them, for now).

Let us know if that gets you sorted.

/Charlie (troubleshooter, carehart. org)

davequested

Participating Frequently

Still no luck Charlie. Even their XML feed doesn't include it:
https://cfdownload.adobe.com/pub/adobe/coldfusion/xml/updates.xml

davequested

Participating Frequently

Fantastic. Are there new installers for CF2023 with this update?

Charlie Arehart

Community Expert

While we await confirmation from Adobe, I'll note that I'd indicated in earlier comments here (one just a minute before yours) that I'd not found there to be any new installers in my own checking.

/Charlie (troubleshooter, carehart. org)

Charlie Arehart

Community Expert

Here's great news (for some): while there were no new installers with original release of the update last week, Adobe has modified this post today to confirm that they HAVE released today new installers that DO include this latest update. I have checked them and confirmed today they are different than the previous ones (whereas on Friday I did NOT find the installers to be different.)

I just wanted to add this comment since Dave had raised the question that first day, and I shared what I found to be true then. It would be easy for many to miss the modification of this post to indicate there are in fact new installers. (Thankfully, Sauarav also offered it earlier today in a later comment thread here.)

/Charlie (troubleshooter, carehart. org)

M

mikes72355015

Adobe Employee

I tried install 2023 on MacOS Sonoma today, and won't do it. I guess we need to wait for an updated installer.

Brian__

Participating Frequently

If you trust the download file and want to allow execution anyway, there are instructions on how to bypass that check here - https://support.apple.com/guide/mac-help/apple-cant-check-app-for-malicious-software-mchleab3a043/mac

Brian__

Participating Frequently

I see that the CF2023U5 release notes has the Mandatory IP restrictions item, but this item is absent from the CF2021U11 release notes (and bug CF-4219181 is offline or inaccessible). Does this change only apply to CF2023R5 and not to CF2021U11? I have some more thoughts on this, but I'll just say for now that this is a great config tweak and one that everyone should make to all ColdFusion environments, even manually if you have to do it.

Charlie Arehart

Community Expert

Brian, this is an interesting discussion you raise. I hope folks will forgive/appreciate my blog-length reply and elaboration.

First, while Adobe can and should answer your question, I suspect the change in fact may not apply to EITHER update. Instead, the verbiage on this point in the technote is talking about how the CF installer would work--and I have confirmed first that there are not new/refreshed installers released with this update. Adobe, do you agree? (I have downloaded the zip and gui installers, and compared them to those I got in July, and they are identical.) (As an update, 4 days later: Adobe modified this post on Oct 10 to indicate that in fact there WERE new CF installers that include these updates. I have confirmed they are indeed different from the previous installers. The rest of what I say in thie comment applies and remains unchanged)

As for whether the update may indeed make any change, it will be interesting to hear from anyone who may have installed CF a) with the production profile (rather than production+secure), and b) who may have had no value entered for "Allowed IP Addresses for accessing ColdFusion Administrator and ColdFusion Internal Directories" before the update: do they now see these localhost values entered for them? (For anyone interested, this setting is at the bottom of the "allowed ip addresses" page in the 'Security" section of the Admin.)

And lest casual readers misconstrue things, this is talking about the production vs developer PROFILE (an option in the installer has long had) rather than the prod vs dev DEPLOYMENT TYPE (which is a new option in the installer since CF2021, also offering values like test, stage, qa, and dr). The latter is tracked (once chosen) on the Licensing and Activation page of the CF Admin (and for now cannot be changed in the Admin, and there's a tracker ticket requesting that).

As for the security aspect of this change, I'll say I've always found it odd not only that the installer prompt discussed (in the technote) would be greyed out for ANY profile selected (even "developer"), as there's value (as you're getting to) for everyone to have the admin locked down to only localhost access (unless you choose to open it up). But I've wondered why it didn't pre-populate with these localhost ips discussed in the technote.

And yes, I realize that with the CF Admin exposed by default only on the built-in web server (which defaults to port 8500), that web server's port would be blocked by any firewall. But if other machines within the firewall/network have that port open, that doesn't mean that everyone who CAN access the port SHOULD be able to try to login to the CF Admin.

So in summary, I'd argue that a) an update should change any servers that have NO value for this field to have localhost ips (with a warning to people that if this change blocks them being able to access the admin, they can use the cfsetup tool--new in cf2021--to be able to modify that ip list). Then b) the installer prompt should also be pre-populated with those localhost ips regardless of profile, with the freedom for the installing user to add to or change that list of ips (if somehow they feel they must). And an argument could be made that c) the admin (and installer) should NO longer allow there to be NO value entered for this allowed ip field, as that means it's open to anyone who can reach that built-in web server port.

If I have anything wrong here in any of the above, I welcome correction.

/Charlie (troubleshooter, carehart. org)

Charlie Arehart

Community Expert

Brian or Adobe, any thought on my comment here from Oct 7 about the "allowed ip address" matter Brian raised?

/Charlie (troubleshooter, carehart. org)

Charlie Arehart

Community Expert

Thanks, Saurav. And wow, this feels almost like a point release rather than an update, with not only bug fixes but so many changes/new features (whereas the past 4 updates had only security fixes). So let's all dig in and see how it goes. Nice to see if this update resolves some long-standing bugs that had troubled us since the previous "major" updates (that fixed previous bugs but added new ones) in Oct 2022 and Sep 2021.

That said, if this update might introduce new bugs itself, I sure hope it won't be a year until an update fixes THESE bugs.

/Charlie (troubleshooter, carehart. org)

Sign up

To post, reply, or follow discussions, please sign in with your Adobe ID.

Sign in to Adobe Community

To post, reply, or follow discussions, please sign in with your Adobe ID.

Scanning file for viruses.

This file cannot be downloaded