UPDATE RELEASED: ColdFusion security updates 14 & 4 released for CF2021 & CF2018.

[Priyank Shrivastava.]

We are pleased to announce that we have released the updates for the following ColdFusion versions:

• ColdFusion (2021 release) Update 4
• ColdFusion (2018 release) Update 14

Note: The ColdFusion Add-Ons and lockdown installers are also refreshed. The refreshed installers are available at ColdFusion downloads.

In these updates, we’ve fixed a few security bugs, and upgraded Tomcat, along with other libraries.

• ColdFusion (2021 release) Update 4
• ColdFusion (2018 release) Update 14
• Performance Monitoring Toolset 2018 Update 5
• Performance Monitoring Toolset 2021 Update 4

These updates fix security vulnerabilities that are mentioned in the security bulletin,  APSB22-22.

The Docker images will be hosted shortly on Docker Hub.

Please update your ColdFusion versions and provide us with your valuable feedback.

[jeffh65754959]

It appears that this hotfix is security related and not feature related.  With CF2018 hotfix 12 we installed hf201800-4212383.jar for the query of queries issue that was introduced with that release.  We had to manually apply it for CF2018  hotfix 13, as well.  I suspect we have to apply it after this CF2018 hotfix 14, as well?

Thanks,

Jeff

[Priyank Shrivastava.]

Hi Jeff,

Yes, you have to re-apply that patch. You can find that in the backup directory or you can copy that before you apply the hotfix from \ColdFusion2018\cfusion\lib\updates folder.

[Dave Watts]

Hi, @Priyank Shrivastava. !

Is this going to be the standard approach for patches in the future? I'm not sure if the QoQ hotfix is intended for everyone or just people running into a given problem.

Dave Watts, Eidolon LLC

[Priyank Shrivastava.]

Hi Dave,

We will try to maintain the standard and separate the updates in the future as well. For the QoQ patch, this is only for the users who encountered the problem and not for those who never used it. 

However, if any user has applied any other private patch, they will have to re-apply that because it will move that patch from the Updates folder to backup directory,

[aaront9258608]

Regarding the QoQ issue, is there any reason this fix still has to be re-done after every update and a permanent fix is not put into an official update?

[jhansen-cf]

CF2021u4 seems break Query of Queries (again). I tried adding the hf202100-4212383.jar (a hotfix for a previous update that broke Query of Queries) and that seem to have fixed it. 

@Priyank Shrivastava. Would you call this a valid solution? Is it too late to add hf202100-4212383 to cf2021u4? 

Attached you will find some stacktraces. Hope this helps. 

Please advise...

[Priyank Shrivastava.]

Hi @jhansen-cf ,

You need to re-apply the patch after you apply the update 4 in your server. This security update does not have any other bug fixes. If you have already applied the QoQ patch and in case that is working. You are good to go.

[BKBK]

Thanks, @Priyank Shrivastava. and Team.

At last a Tomcat upgrade to 9.0.60, thereby averting the vulnerability CVE-2021-42340

Good show!

[BKBK]

@Priyank Shrivastava. , could you please clear up one source of confusion. You will find the following on the security page, https://helpx.adobe.com/security/products/coldfusion/apsb22-22.html :

On JEE installations, set the following JVM flag, "-Djdk.serialFilter= !org.mozilla.**;!com.sun.syndication.**;!org.apache.commons.beanutils.**", in the respective startup file depending on the type of Application Server being used.   

For example:   

Apache Tomcat Application Server: edit JAVA_OPTS in the ‘Catalina.bat/sh’ file   

Consider the usual, standalone ColdFusion installation. That is, a ColdFusion installation that is not installed as a JEE web application deployed on a JEE application server such as WebLogic, Tomcat or WildFly. 

The question is, do you have to apply the jdk.serialFilter flag to such a standalone ColdFusion?

Could you please clarify. Confusion arises because a standalone ColdFusion installation still runs on Tomcat, albeit not as a deployed JEE web application. . 

[Priyank Shrivastava.]

@BKBK If you have installed CF as standalone then these flags are not required in jvm.config. These are only for J2EE deployment if you are using WebSphere, WebLogic, Tomcat, JBoss, etc.

I hope this answers your question.

[BKBK]

Thanks, @Priyank Shrivastava. . Yes, you've answered my question.

[Charlie Arehart]

Priyank, this is indeed a frequent source of confusion with folks. I see or hear it often. Could you guys revisit that paragraph (for this and all technotes) to add even just a sentence or two to explain things for folks on typical deployments, who are always left wondering (if not savvy tabout the j2ee distinction)? 

[Priyank Shrivastava.]

Hi Charlie, let me see what I can do about that. 

[raspin]

Two questions:

1.

How come your Update 4 details on https://helpx.adobe.com/coldfusion/kb/coldfusion-2021-updates.html do not include a "Hotfix and packages repository" which your instructions expect - hence the instruction to "Unzip the repository".

2.

Have you updated any base installers that include Update 4? Or are we expected to apply the hotfix even if we download the latest installers. If you do have an updated installer (in my case the "Adobe ColdFusion 2021 Windows 64 Bit GUI Installer"), where would I find it?

[raspin]

Any chance of a reply from Adobe?

[Dave Watts]

They may have already provided that information in the thread.

Dave Watts, Eidolon LLC 

[Priyank Shrivastava.]

@raspin We did not make any changes that require the packages to be updated, hence there is no repository in update 4. If you have applied update 3, then you can directly install update 4 without any repository however, if it is update 2, then you have to download the packages for update 3, and then only you can apply update 4.

We have not refreshed the installers in this update. 

I hope this answers your question. 

[raspin]

The spaghetti instructions of your last post pretty much sum up the problem here. Why not just include everything that is needed for update 4 in update 4? We have hotfixes scripted so if you suddenly decide to change the method (by not including all that is needed in the latest hotfix) it just breaks the pattern. At the very least update your instructions, which still refer to "unzipping", where there is nothing to unzip in update 4.

[raspin]

In the absence of an updated packages file I have created one using the packages from update 3 and rearchived with update 4. It seems to update successfully according to CF's own reporting. This might seem trivial and unnecessary but with automated deployments consistency is vital. So, I would urge Adobe to release both versions of the update with each hotfix or otherwise mention this difference in the instructions, which are currently incorrect. In the unlikely event someone out there needs this packages file I would be happy to provide.

[pfurrer]

I have the following problem: After installing update 14 (CF 2018 release, Windows Server 2016, patched), the CF-service starts normally but it is no longer possible to access it.

- Connecting to the CF internal webserver throws an error 500
- Connection through IIS triggers the following error in isapi_redirect.log:

[info] jk_open_socket::jk_connect.c (816): connect to 127.0.0.1:8018 failed (errno=61)
[info] ajp_connect_to_endpoint::jk_ajp_common.c (1140): (cfusion) Failed opening socket to (127.0.0.1:8018) (errno=61)
[error] ajp_send_request::jk_ajp_common.c (1811): (cfusion) connecting to backend failed. Tomcat is probably not started or is listening on the wrong port (errno=61)
[info] ajp_service::jk_ajp_common.c (2982): (cfusion) sending request to tomcat failed (recoverable), because of error during request sending (attempt=2)
[error] ajp_service::jk_ajp_common.c (3003): (cfusion) connecting to tomcat failed (rc=-3, errors=10, client_errors=4).

I've tried different things:
- Uninstall the update manually (CF Admin not available): no change

- Rollback + Installing the update manually: same result
- Updating the connector, adopting various working settings from our testing-System (where the security update 14 was no problem): unfortunately no success

My questions:

- Is there also a log file form the CF internal webserver?

- I suspect there is a problem with the Tomcat 9.0.60 update. Are there any specifig logs or test possibilities to identify the problem?

Thanks,

Patrick

[Vikram Kumar M]

Hi Patrick,

Could you please try to start the ColdFusion from the command prompt and share the output here?

Open the command prompt as admin, navigate to \ColdFusion2018\cfusion\bin folder and run cfstart.bat and share the output.

As per the connector logs, it appears like binding is failing.  Try adding the IP address in server.xml and worker.properties and see if it helps.

Error:

[info] jk_open_socket::jk_connect.c (816): connect to 127.0.0.1:8018 failed (errno=61)

Add the IP address of the machine instead of localhost in worker.properties as shown below: 

Example: 

worker.cfusion.type=ajp13 
worker.cfusion.host=IP-address-of server 


Server.xml: Add "address" attribute in connector protocol with IP address as shown below: 

Example: 

    <Connector protocol="AJP/1.3" port="8020" address="IP-address-of server" redirectPort="8453" secret="xxxx-xxxxxx-xxxxx-xxxx-xxxx" maxThreads="500" connectionTimeout="60000" tomcatAuthentication="false"/> 

Restart both web server and CF and check if it helps. 

Thanks,

Vikram

[Charlie Arehart]

Adding to Vikram's suggestions (which may alone get you going) , what cf2018 update had you been on before trying 14? That may suggest other considerations.

And since you're on Windows, when you ran the manual update from the command line, did you" run as admin"? Did you stop all the cf services (the update should do it, but you could for good measure). 

Finally, I would recommend also that you look at the cf update log. One will have been created for each install or uninstall, in the cfusion/hf-updates folder for that update. Look for the count of fatalerrors. For more, see a post I did:

"How to solve common problems with applying ColdFusion updates (in 10 and above)" https://www.carehart.org/blog/2016/9/6/solve_common_problems_with_CF_updates_in_10_and_above

Let us know if any of our suggestions help. 

[pfurrer]

Hi Vikram, Hi Charlie

Thank you very much for your valued replies!

Regarding the installation:
- update 13 is currently installed

- the update 14 intallation log showed no errors or warnings:

Installation: Successful.

3438 Successes
0 Warnings
0 NonFatalErrors
0 FatalErrors

- I ran it from command line with admin rights (CF + IIS services down)

I will try and check it again in 2 weeks (maintenance window), especially adding the ip address to the connector/server.xml. But I'm not sure if it's really a connector problem, because I can't access the internal webserver either. Maybe the prompt shows more information then.

Thanks for your help - I will report again 😉
Patrick

[Charlie Arehart]

All great to hear. Yep, an update from 13 to 14 should be uneventful. And there should be no need of any connector update (it did not change with 14), nor should there be any NEED of a change to the server.xml (but Vikram's suggestion is still worth trying).

That said, how long had it been since you restarted the cf instance, BEFORE the update? I ask because your issue may not be with the update, but with some change made to cf or its config files (including that server.xml) that was made previously but would not take effect until a cf restart. It's worth checking.

And either way, you asked about a log for the internal web server. There's no separate one, as it starts up "within" cf (as it were). So look to the coldfusion-out.log and coldfusion-error.log, for the lines during cf startup (when you have this problem), to see what it may complain about. There may be an issue with some config file that might be obvious. Let us know if you see something but can't connect the dots.