NOW LIVE! ColdFusion 2025, 2023, and 2021 July security updates

[Saurav_Ghosh]

We are pleased to inform you that we've released security updates for ColdFusion 2025, 2023, and 2021 releases. For more information, see the respective tech notes:

• ColdFusion (2025 release) Update 3
• ColdFusion (2023 release) Update 15
• ColdFusion (2021 release) Update 21

The updates include a newer version of Tomcat, important security fixes that mitigate vulnerabilities related to arbitrary file reads, code execution, privilege escalation, and security feature bypass.

 View the security bulletin, APSB25-69, for more information.

Download the updates

• ColdFusion 2025 updates
• ColdFusion 2023 updates
• ColdFusion 2021 updates

What's new in the updates

• Tomcat upgrade
• New JVM flag
• Changes to remote methods
• OEM upgrades

Others

• Bug fixes
• Known issues

Docker and CFFiddle

• CFFiddle is updated with the changes.
• Docker images of the update are avaiable on Docker hub and Amazon ECR.

Please download and apply the updates and provide your feedback.

[paulm1677332]

Hi, 

We're using latest 2023 docker image on our dev sites and from the logs it was looking for some user interaction to install some packages. 

"One or more packages require the server to be at update 15. Since the server is at update 14, upgrading the server to update 15." Then it asks to "Do you want to proceed? Press N to stop. Press Y to proceed:" As its autodeployed it just hangs at this point and out sites didnt work. There was only 2 packages deployed and we install allModules as part of the build. Do we need to wait for new docker image or is there another workaround to get things building automatically again?

Thanks

[Charlie Arehart]

Paul, there are a couple of ways to look at what you've presented--and yes, a workaround, though we should better understand and confirm your problem as well. 

First, as you may know the new docker images for each update tend to come out a couple days after the update's initial release.

That said, one should be able to do the update (or package updates) within the container...but like with a regular cf instance, that needs to be able to access the Adobe servers which hold the update files. And it's not unusual for a container environment to be configured such that IT CANNOT make outbound network requests, as a security protection.

And just as with a regular cf instance, the update technotes do discuss how one can instead perform a manual offline update, which entails a couple extra steps. Those could work in a container.

But it's indeed odd that you say this message "just happened" unexpectedly: it would normally happen only to someone (with any form of cf deployment) who somehow told cf to update to a package whose version was higher than the current update level of cf (what they refer to in the admin Package Management ui as the "core" update.)

If you look at your dockerfile, compose file, or kubernetes manifest (whatever means you're starting cf as a container), you should find you have the installModules env var set to name what packages you want implemented (Or you may find an importModules, which names a file listing the packages to be implemented.) Those package names can include version numbers, but I'd not expect yours to already name the next version--and I'd not expect it to "automatically seek the highest available version".

Anyway, let us know your value for that env var. And note that for now you could workaround this problem by instead setting that env var to name the update 14 version of those packages, thus "pinning" the package version. Again, you should not have to do that.

Then let's see if Adobe or others have more to offer. I also hope to setup a demo if your situation, especially with whatever values you have for installModules or importModules. 

[paulm1677332]

Hi Charlie,

The relevant lines in the dockerfile are

FROM public.ecr.aws/adobe/coldfusion:latest-2023 AS base

ENV installModules all
We build the image then push to AWS and everything gets started via a service and task. No issues at all until yesterday evening. If I login to the CF Admin I see that only 2 modules are installed. I need to login to the container and install sqlserver to get the sites up and running. 
Paul

[Suchika]

Hi Paul , 

I brought up a container using below command - 

docker run -dt -e acceptEULA=YES -e installModules=all -p 8500:8500 adobecoldfusion/coldfusion2023 and all modules were installed . Are you still facing this issue?

[paulm1677332]

Hi Suchika,

As mentioned we use public.ecr.aws/adobe/coldfusion:latest-2023 to build our images. I noticed that this image was updated yesterday and everything works now again on our end. Nothing has changed just the image.

[Charlie Arehart]

So Paul (and Suchika), I'll say this certainly all seems odd. And since you're working again (with the image now being updated by Adobe), perhaps you'll leave it be. But if you (or others) may want to explore more, read on

It seems the issue MIGHT have been that your image (its cf "core") was still on u14 but somehow it tried to update the packages to u15...but it's not "supposed to" do that (whether running cf as a container or not). My understanding is that CF should only implement package versions suited to the current core version...

... That is, unless you specifically TELL it to get a later package version, and then yes it warns that the core would need to be updated and awaits confirmation (whether done in the admin or at the cli. And yes, the cf docker image's env vars for package mgt do cause cf to silently run the cfpm at the cli for you within the container. ..which is where it got stuck.) 

So the question is WHY it tried to use updated packages for your "install all". Any thoughts, Suchika?

If not, I'd be. curious then to know what else might have been tracked in your cf logs...and for that I mean more than just what "docker logs" would show--that's just what's in the stdout and stderr, which equates to the coldfusion-out.log and coldfusion-error.log.

In particular there may be useful info in the cfpm-audit.log. (Of course, if your failing container has since been removed then you won't have it.) But for future reference I'll note that it's NOT just tracking when one uses the cfpm cli tool: it tracks also when a cf update leads to package updates.

So it should track what happened (unexpectedly) in your case. (FWIW, anyone looking at that should beware that it ALSO tracks a few hundred lines on EVERY startup of cf.)

I'm just saying that whatever happened to you, it's going to be explained in cf's logs (most of which are NOT exposed as docker logs by default.)

Again, you may well be "done" with this round. I leave this for the "next round", or for anyone else who faces/faced this scenario you presented. 

[Suchika]

The Docker images were updated later, while the package URL was already pointing to Update 15. This creates a very small window of inconsistency. However, you're right — if the core is at Update 14 and you run install all after Update 15 goes live, it should upgrade both the core and the packages to Update 15. Will check with the team on this.

[paulm1677332]

As you suspected Charlie that container is long gone. All I have is a screenshot from aws logs which I will attach here.

[IT- Dani33671629ivjj]

We are getting this error on pages that use cfmail after updating from 2021 Update 20 to 2021 Update 21.  We updated to Java 11.0.27 when we updated to 2021 Update 20. CF admin verifies that the connection to the mail server is successful.

Bad type on operand stack
Exception Details:
Location:
coldfusion/mail/MailImpl.signMail(Ljavax/mail/internet/MimeMessage;Ljavax/mail/Session;)Ljavax/mail/internet/MimeMessage; @238: invokevirtual
Reason:
Type 'org/bouncycastle/asn1/smime/SMIMEEncryptionKeyPreferenceAttribute' (current frame, stack[1]) is not assignable to 'org/bouncycastle/asn1/ASN1Encodable'
Current Frame:
bci: @238
flags: { }
locals: { 'coldfusion/mail/MailImpl', 'javax/mail/internet/MimeMessage', 'javax/mail/Session', 'java/security/KeyStore', '[Ljava/security/cert/Certificate;', 'java/security/PrivateKey', 'org/bouncycastle/asn1/ASN1EncodableVector', 'java/security/cert/X509Certificate', 'java/lang/String', 'org/bouncycastle/asn1/cms/IssuerAndSerialNumber' }
stack: { 'org/bouncycastle/asn1/ASN1EncodableVector', 'org/bouncycastle/asn1/smime/SMIMEEncryptionKeyPreferenceAttribute' }

[marktb]

We are too!

[marktb]

We fixed ours by cleaning the felix cache

1. Stop Coldfusion
2.  delete the cfusion/bin/felix-cache directory
3. Start Coldfusion

[IT- Dani33671629ivjj]

Thank you! I'll try that.

[IT- Dani33671629ivjj]

It worked!  I'm no longer getting that error and things are functioning as expected.  Thank you!

[WangShen St.Louis]

I got the same error. I will try to apply this method.

[Roberto A.]

I encountered the same error and resolved it the same way. Odd because the felix-cache was deleted during the installation of the jar file. Seems it needs to be manually deleted a 2nd time.

[Lee Boardman]

Thank you, this has been driving me crazy all morning! Your suggestion works for me too.

[richt82047916]

We also needed to delete the felix-the-cat folder to get our cfmail tags to work. 

[Adam21882425uwu2]

This fixes the same issue in ColdFusion 2023 as well.

This should probably be added to the known issues for ColdFusion (2023 release) Update 15.

[tapechtc]

Fixed the same cfmail issue in ColdFusion 2025

[mindfart23587]

Weird thing is, on a couple servers where I had this issue, it had sent mail after the patch. Only atfer about 3 days did this error occur. I wonder if it will break again in a couple days.

[mindfart23587]

Yep, this issue is now re-occuring on at least 1 cf server. This issue will keep happenign and you will have to keep clearing the cache... Please fix @Saurav_Ghosh 

[jfr91217243]

@mindfart23587 : I confirm, i have the same probelm on at least one server.  I updated it last wednesday, after clearing the Felix Cache, the mail function was ok, but this morning, i got an error.  I had to clear the Felix Cache again and now it works.  I will open a bug on the Adobe site.

[Stephen34242757cq5j]

Thanks for creating the issue! Everyone please vote: https://tracker.adobe.com/#/view/CF-4227360!