The following ColdFusion updates are now available for download:
ColdFusion 11 Update 5
This Update includes approximately 115 bug fixes related to Language, Mobile Support, File Management, Document Management, Administrator, Connector and several other areas.
It also addresses a vulnerability mentioned in the security bulletin APSB 15-07 and support for Apache 2.4.10. With this update the Web Server Config tool now backs up all the connector configurations files.
For the details refer this technote.
ColdFusion 10 Update 16
ColdFusion 10 Update 16 includes approximately 35 bug fixes related to File Management, ORM, Language, Document Management and certain other areas. It also addresses a vulnerability mentioned in the security bulletin APSB15-07.
For the details refer this technote.
Newbie
25 posts
@charlie
Thanks for the response, albeit delayed.
That was a long time ago. I’m actually with a different company now. I don’t remember if/how we got it resolved back then. I don’t think we did though.
Byron,
The upgrade option should work fine.
Thank you Piyush for comment 77.
I see that wsconfig.exe has an “upgrade” option from command line. (I have read Charlie’s excellent blog about the “upgrade” option and also the wsconfig user guide).
Can we use this “upgrade” option with ColdFusion 11 Update 5?
(our problem: the wsconfig GUI (remove/add) breaks all of our custom CFIDE mappings and other CFIDE settings, such as IP restrictions, etc).
Thanks in advance,
Byron
Updated CF 10 to Update 16. Everything was looking good until recently. We use CFIMAGE to resize and get thumbnails from images for display purposes. After the update, our thumbnails look like crap. What happened????
@Charlie Sorry for taking so long to respond. Happy to provide the stacktrace. Would be thrilled to know if it points to anything that we can address. Thanks!
“ajp-bio-8012-exec-5876” Id=28791 RUNNABLE (in native)
java.lang.Thread.State: RUNNABLE
at java.net.SocketOutputStream.socketWrite0(Native Method)
at java.net.SocketOutputStream.socketWrite(SocketOutputStream.java:109)
at java.net.SocketOutputStream.write(SocketOutputStream.java:153)
at org.apache.coyote.ajp.AjpProcessor.output(AjpProcessor.java:307)
at org.apache.coyote.ajp.AbstractAjpProcessor$SocketOutputBuffer.doWrite(AbstractAjpProcessor.java:1258)
at org.apache.coyote.Response.doWrite(Response.java:520)
at org.apache.catalina.connector.OutputBuffer.realWriteBytes(OutputBuffer.java:412)
at org.apache.tomcat.util.buf.ByteChunk.append(ByteChunk.java:371)
at org.apache.catalina.connector.OutputBuffer.writeBytes(OutputBuffer.java:442)
at org.apache.catalina.connector.OutputBuffer.write(OutputBuffer.java:430)
at org.apache.catalina.connector.CoyoteOutputStream.write(CoyoteOutputStream.java:91)
at com.intergral.fusionreactor.j2ee.filter.surrogate.FusionReactorServletResponseInterposer$1.write(FusionReactorServletResponseInterposer.java:75)
at com.intergral.fusionreactor.j2ee.trackedstream.TrackedStream2.write(TrackedStream2.java:31)
at com.intergral.fusionreactor.j2ee.filter.softkill.SoftKillResponseStream.write(SoftKillResponseStream.java:104)
at coldfusion.runtime.CachedBufferedOutputStream.flushBuffer(CachedBufferedOutputStream.java:102)
at coldfusion.runtime.CachedBufferedOutputStream.flush(CachedBufferedOutputStream.java:171)
– locked coldfusion.runtime.CachedBufferedOutputStream@dc2dd82
at sun.nio.cs.StreamEncoder.implFlush(StreamEncoder.java:297)
at sun.nio.cs.StreamEncoder.flush(StreamEncoder.java:141)
– locked java.io.OutputStreamWriter@36d40526
at java.io.OutputStreamWriter.flush(OutputStreamWriter.java:229)
at java.io.PrintWriter.flush(PrintWriter.java:320)
– locked java.io.OutputStreamWriter@36d40526
at coldfusion.runtime.NeoJspWriter.flush(NeoJspWriter.java:320)
at coldfusion.runtime.NeoPageContext.flushOutput(NeoPageContext.java:2010)
at coldfusion.filter.BrowserFilter.invoke(BrowserFilter.java:42)
at coldfusion.filter.NoCacheFilter.invoke(NoCacheFilter.java:58)
at coldfusion.filter.GlobalsFilter.invoke(GlobalsFilter.java:38)
at coldfusion.filter.DatasourceFilter.invoke(DatasourceFilter.java:22)
at coldfusion.filter.CachingFilter.invoke(CachingFilter.java:62)
at coldfusion.CfmServlet.service(CfmServlet.java:219)
at coldfusion.bootstrap.BootstrapServlet.service(BootstrapServlet.java:89)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at coldfusion.monitor.event.MonitoringServletFilter.doFilter(MonitoringServletFilter.java:42)
at coldfusion.bootstrap.BootstrapFilter.doFilter(BootstrapFilter.java:46)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at sun.reflect.GeneratedMethodAccessor93.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:497)
at com.intergral.fusionreactor.j2ee.filterchain.WrappedFilterChain.doFilter(WrappedFilterChain.java:97)
at com.intergral.fusionreactor.j2ee.filter.FusionReactorRequestHandler.doNext(FusionReactorRequestHandler.java:472)
at com.intergral.fusionreactor.j2ee.filter.FusionReactorRequestHandler.doHttpServletRequest(FusionReactorRequestHandler.java:312)
at com.intergral.fusionreactor.j2ee.filter.FusionReactorRequestHandler.doFusionRequest(FusionReactorRequestHandler.java:192)
at com.intergral.fusionreactor.j2ee.filter.FusionReactorRequestHandler.handle(FusionReactorRequestHandler.java:507)
at com.intergral.fusionreactor.j2ee.filter.FusionReactorCoreFilter.doFilter(FusionReactorCoreFilter.java:36)
at sun.reflect.GeneratedMethodAccessor53.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:497)
at com.intergral.fusionreactor.j2ee.filterchain.WrappedFilterChain.doFilter(WrappedFilterChain.java:79)
at sun.reflect.GeneratedMethodAccessor50.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:497)
at com.intergral.fusionreactor.agent.filter.FusionReactorStaticFilter.doFilter(FusionReactorStaticFilter.java:53)
at com.intergral.fusionreactor.agent.pointcuts.NewFilterChainPointCut$1.invoke(NewFilterChainPointCut.java:41)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:950)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:422)
at org.apache.coyote.ajp.AjpProcessor.process(AjpProcessor.java:199)
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:607)
at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:314)
– locked org.apache.tomcat.util.net.SocketWrapper@38d4fba9
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:745)
Has anyone seen this CFPOP bug since applying the update?
[subscribe]
Any update on this?
@Piyush Yes, caching settings are optimally set – all those settings are enabled. We are also using cfache on the pages in question.
It is the same .cfm templates that are generating the longer processing times. 99% of the time when they run, they are fine: uncached they might run around 300-400ms, cached they’ll only take 1ms. But they pop up in Fusion Reactor with times ranging from 10,000-30,000ms on occasion, which is really troubling. We did not have this issue before updating.
Additionally, we know it’s not the queries on the page. Their execution time is consistently low, even when the template takes a long time to load.
Matthew,
Can you confirm if the caching settings at CF administrator> Server Settings> Caching are optimally set.
On a production system you may specifically want the following settings enabled:
Component cache, Trusted cache, Cache template in request, Save class files.
Can you also confirm if it is the same cfm pages, that are taking longer to process, everytime.
@Samson,
This issue was reported as Bug , which is fixed now.
For more information please refer, https://bugbase.adobe.com/index.cfm?event=bug&id=3971083
Regards,
Nimit
I’m having issues with output parameters on a stored procedure. I used to have dbvarname, but that stopped any output parameters from working. I removed those around update 3.
Now I’m having issues with my 3rd output parameter in a procedure that’s working just fine under cf9.
The other two parameters come out as local just fine. They are varchars. This doesn’t work as either a numeric or integer.
When I try to assign arguments.customerid = local.customerid it tells me local.customerid doesn’t exist. Since it’s a number and the default of the proc is null, I’m just assuming that CF is getting a real null for the value and treating it as undefined.
Again, thanks Charlie. We’ve done that, but the information hasn’t been helpful. No references to .cfm templates in the stack traces. Doesn’t seem to be a specific line of code triggering the long load times (which would make sense, since the only thing that has changed was the update to 16). Considering rolling back to see if that corrects the issue.
Thanks for the response Charlie. I could have articulated my original question more clearly. The issue that we’re seeing has to do with increased response times, which I thought may have been related to a decrease in caching performance with the update.
The particularly slow responses (30s+) are occurring irregularly, which is to say, it’s hard to catch them in FR.
Now that the weekend has past, I’ve got some more specifics. Prior to updating, we were seeing our average template response time (via FR daily reports) at around 40ms. Post update, that number has gone up to close to 60ms. In the grand scheme of things, not a huge difference, except that it seems the average is really being driven up by some irregular, extremely long response times.
Some further digging showed that memory usage also spiked (from using 25% of heap preupdate, to around 75% now). We just ran the garbage collector manually and are trying to track down what is causing the increase. It seems to be climbing back up again. The perplexing aspect is that nothing has changed, except for the update to CF.
I’ll update if we manage to find the culprit. Any suggestions are appreciated.
Can you lot please sort your unsubscribe function out? I’ve unsubbed from this thread at least three times now.
Cheers.
—
Adam
[subscribe]
Anyone else notice a decrease in caching performance (ehcache / trusted cache) with update 16 to CF 10.
I don’t have specifics yet, but we’re looking at FusionReactor and seeing some longer loading templates than we’ve had in a while. Templates that typically never ran longer the 5/6/7 seconds are, on occasion, hitting 20-30. Odd behavior, just wondering if anyone else is seeing similar.
We rebuilt connectors (yes, as admin) and cleared the class files as well.
(We’re running Windows Server 2008 R2, IIS 7.5.)
Thanks so much Charlie and Piyush for the helpful information. I had to revert from a previous image as I was not able to get it working before i had to bring our servers online again, i should have saved the logs. I did indeed make sure to read your article Charlie and i ran as admin. When i say i removed I mean that i launched the connector app and then selected [All Sites] which already existed and clicked Remove. Then I added it back as i assumed this is what is needed to be done to reset the connector after an update? I will give this another try this weekend and then post back with a response. If it fails again ill save the logs. I did also notice that the Handler mappings for the Server level in IIS was pointing to /config/wsconfig/1/ which was not the newest one that was created. Each time i tried to run the connector it created a new /config/wsconfig/x and the last one was /config/wsconfig/5/ None of the handler mappings for .cfm were pointing to that new one. I tried to manually change it and restart CF/Web/Server and still no go. So it was like the connector didnt seem to do anything at all. Anyways, will post back after i try this again. Wish CF was not so finicky with updates these days…
Stephen,
When you create an IIS connector here’s what happens at the webserver’s end:
– virtual mappings are created for CFIDE (points to CFIDE in CF’s internal wbroot) and jakarta (points to the folder containing the isapi_redirect DLL)
– handler mappings are created for .cfm, .cfml, .cfc, .cfr, cfswf files.
– An ISAPI filter is configured pointing to isapi_redirect.dll (at /config/wsconfig//).
– default document for the site is set to index.cfm
(If you are creating a connector with “All sites”, these attributes will be set the server level rather than a site level)
And here’s what happens at the CF server end:
– A folder is created at /config/wsconfig/ which contains the isapi_redirect.dll and other properties files.
– The connector properties are stored in the wsconfig.properties file at /config/wsconfig/.
– The steps performed by the WSconfig tool to create the connector are logged in the wsconfig.log file at /config/wsconfig/wsconfig.log
– And finally the wsconfig tool restarts the webserver with a message prompt.
The content of the wsconfig.properties file would look something like this:
1=IIS,2,true,””,bitness64
1.srv=localhost,cfusion.
where, 1 just an index number. If you have multiple connectors you’ll have additional lines starting with 2.. and so on.
2 is the ID of the website you are creating the connector with. If you are creating a connector with “All Sites” this number should be set to “0”.
bitness64 is the “bitness” of the connector you are creating. If you check the “configure 32 bit webserver” option in the wsconfig tool UI, this will be set to “bitness32”. Ensure that this setting matches the corresponding setting of the application pool of your website.
After creating a connector you can check if these settings/files/folders are physically present. If not delete or remove any stale files or settings and try running the tool again with administrator privileges.
As suggested by Charlie, you should check the wsconfig.log for clues first.
Greg/Apul,
Looks like there’s a change in the behavior with Update 5 when using IE11.
Hitting the enter key in the input box does not submit the form, but clicking anywhere outside the input box does.
will investigate further and get back.
Im on Windows 2008 r2/ IIS 7.5 running 64 bit. I installed this update then did as I was instructed and ran the Web Configuration Connector app as Admin, removed the existing All Sites. Then Added all sites. Restarted my Server and CF pages no longer load. Also i do not see in any of my directories Jarkarta or CFIDE. Anybody have any idea what went wrong here? Its like the connector just didnt work. Any help would be greatly appreciated!
Well I will need to revert part my previous comment, as I just tested on cf10 and I get an error as well for passing a numeric value with a comma. So I will do my due diligence to make sure I remove commas from this legacy codebase I am working/supporting on now when passing it into a function.
Hey Greg #67 After clearing the classes it worked then stopped? So I had to revert to taking out the cfform and cfinput and making it regular inputs. My other CFFOrm and CFINPUT code seems to work so some do and some do not.
So I had to revert this hotfix because it just introduced too many errors. Pretty much all those mentioned above and it appears that numeric validation is broken.
In an old site using cfform validation, a field that was being validated as a float now fails if a comma is there. For instance 1,000.00 fails where as 1000.00 does not and this never happened before. Another place, it is also broken at a cfargument level. A cfargument with a type of numeric fails if the value like above is passed with a comma as where before it has not.
I honestly refuse to add it to the bug base as sometimes it feels like it is not looked into unless voted up (experience with the WebSocket issues I originally posted). I think this should suffice for the team to test and apply a fix.
Had the same encrypt issue. Followed the instructions on deleting the files from cfclasses and restarting cf service. Seems to be working so far.
Nothing is output in the IE console. We are running ColdFusion 11 Update 5 on Windows Server 2008. I agree, it is working in Firefox and Chrome. Our primary browser in our corporate is IE9, it wont post. I did a test with IE11, it did not work for me either.
Greg,
I am unable to observe the issue with the code you’ve shared on Chrome and IE11. On submit, I am posting the content to the same page.
Do you see this across different browsers? Do you see any errors logged in the browser debugger? Also what platform is your ColdFusion hosted on?
I am experiencing the same issue as comment #35. cfform/cfinput no longer working after installing update5 using Internet Explorer 9 or 11 (Firefox does work but is not used in my company). The form should submit when pressing enter in the text field, it does not submit. I tried clearing template cache, deleting cfclasses, restarting, etc. Uninstalling Update5 (back to Update4) worked.
@Welton, I just tried cooking up a simple repro case for <cflocation url="”>, and it works good for me.
Are you using one of the CGI variables to identiy the home.cfm path? Also, are the connectors reconfigured after applying HF5?
Hello,
After upgrading to update 5 when using cflocation, the path is adding rather than replace.
In our case, in checking the login screen after being made, I use cflocation, just passing the file name, because this in the same folder.
But for some reason, rather than redirect to the page, and this is concatenated with the current page.
ex .:
The current page is => local / path / index.cfm
Rather than change to => local / path / home.cfm
This is what happens => local / path / index.cfm / local / path / home.cfm
@Roland and @Charlie, I also confirmed this in January.
@Dattanand and @Vamsee, 3975890 is a duplicate of 3929327.
Thanks!,
-Aaron
@Rachael, not sure why the Encrypt signature change issue would resurface after you’ve cleared the cache. Could it be that you are operating in a clustered environment? If so, you might want to clear the cache from all instances. Hope that helps.
@Haxtbh, the below “Known Issues” URL has been linked to from within the update notes and talks about the Encrypt signature change.
https://helpx.adobe.com/coldfusion/release-note/coldfusion-11-update-5—known-issues.html
That said, perhaps a mention of the same in the main tech note article would have been a better option.
@Roland, to add to what Dattanand mentioned, this seems to be an issue for .PNG images. The code worked fine for other image types.
@Dattanand – thanks for looking into it!
@Charlie – I appreciate the suggestions, but believe me, I didn’t come and post a reproducible test case and a stack trace without trying those things first. 😉
@Piyush This should probably be mentioned in the update notes, much like you mentioned the web connector needing rerunning.
A number of people have experienced this issue and people are not expecting to have to clear out or recompile cfml after an update.
Those who don’t subscribe to this blog may never know how to resolve this!
@Roland
we acknowledge that this is a bug that existed from CF11 and I have logged a bug for this issue Bug# 3975890.
Tom/Chris/David/Rachael,
The signature of Encrypt method has changed with Update 5. The method is no longer static. So pre-compiled cfm pages that are using this method will result in the “”Expected static method” error.
To rectify this behavior you need to delete those classes from the {cfrootdir}/wwwroot/WEB-INF/cfclasses directory and clear the CF cache (CF administator > Server Settings > Caching).
In case the affected application is hosted on multiple ColdFusion server instances, ensure that you have followed the steps mentioned above for all the server instances.
If you are using pre-compiled classes, you need to get the cfml pages compiled again.
We can no longer delete image files in CF11 after update 4 or 5. The following code now fails with the message “ColdFusion could not delete the file c:inetpubcns_root2test2.png for an unknown reason.” If you try to delete the file through windows explorer, you get the message “File cannot be deleted because it is in use by coldfusion.exe”. If you wait about a minute, then you can delete the file.
This has broken every piece of image processing code.
cfset f = “C:inetpubcns_root2test2.png”
cfset img = ImageNew(f)
cffile action=”delete” file=”#f#”
Trace:
coldfusion.tagext.io.FileUtils$CouldNotDeleteFileException: ColdFusion could not delete the file C:inetpubcns_root2test2.png for an unknown reason.
body: at coldfusion.tagext.io.FileUtils.delete(FileUtils.java:1061)
body: at coldfusion.tagext.io.FileTag.delete(FileTag.java:550)
body: at coldfusion.tagext.io.FileTag.doStartTag(FileTag.java:355)
body: at coldfusion.runtime.CfJspPage._emptyTcfTag(CfJspPage.java:2991)
body: at cftest2ecfm1733740874.runPage(C:inetpubcns_root2cfmtest.cfm:7)
body: at coldfusion.runtime.CfJspPage.invoke(CfJspPage.java:246)
…
Please vote on this bug. https://bugbase.adobe.com/index.cfm?event=bug&id=3971069
We are experiencing the Expected static method coldfusion.runtime.CFPage.Encrypt(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String; error also.
We clear the cache and things will work for a few days and then it’s back.
I have experience the same error on working pages before update 5.
Details: Expected static method
How do I clear the cache?
On the Encrypt issues.
We pre-compile our CFM and CFC templates, our customers now have CF11 compiled binaries that don’t work with updater 5. Have the java classes for Encrypt changed so much that it’s not compatible with pre-updater 5? is there a way Adobe could rectify this?
“Expected static method coldfusion.runtime.CFPage.Encrypt(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;”
Subscribe
FYI over at stackoverflow: http://stackoverflow.com/questions/29778570/cfstoredproc-no-longer-returns-results-after-cf11-update-5
[subscribe]
Found a bug with IMAP. getHeaderOnly() takes a very long time when messages have large attachments.
I cannot share the code. It isn’t mine to share.
Uninstalling update 5 did resolve the issue on the last page that wouldn’t render. All of the pages are working at this point.
Piyush, same sporadic issues here with Encrypt. On the same page, a few lines of decrypt and encrypt work fine till it gets to this one:
Tried restarting the server with no change.
Side note, I found that the following is no longer valid and would throw the coldfusion.runtime.CFPage.Encrypt(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String; null
error:
it needed to be changed to:
Chris
@Piyush The code had started to work again after clearing the classes. Must have been a related issue.
Tom,
Can you share the relevant code that is causing the exception.
You can share the cfm page or just the relevant code extract.
just wondering why it would work in all cases but one.
You can mail it to pnayak@adobe.com
Subscribe
Just wanted to throw a “me too” in on the “Expected static method coldfusion.runtime.CFPage.Encrypt(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;”
error.
Typically, we disable all caching. However, a class file got generated before I could disable the settings. Deleting the class file and restarting CF 11 u5 seems to have resolved 99% of our issues. Though, one page is still throwing the error.
I did rebuild the connector and it still hasn’t resolved the error. Working with the vendor to address.
@Apul,
The snippet you shared seems to work fine. What kind of error are we expecting here?
Apul,
Can you please explain what the code snippet you’ve shared, is intended to do.
Also what is the error or behavioral change post Update 5?
You may also mail me the details at pnayak@adobe.com.
Hi MRC,
JDK 1.8 is supported. Ref. http://wwwimages.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/cf11/coldfusion11-support-matrix.pdf
Any update level with the supported version should be fine.
what is the latest version of the Java JVM that is supported ?
After the latest update on CF 11 the following CFFORM and CFINPUT statement stopped working? Is there an issue with how CFFORM and CFINPUT work in CF 11? Any suggestions.
-cfform action=”/search.cfm” method=”get” name=”headerSearch” id=”headerSearch”-
-fieldset-
-legend-Search-legend-
-cfinput type=”text” autocomplete=”off” name=”q” id=”headerSearchTerms” maxlength=”255″ value=”#headerSearchTerms#” /-
-/fieldset-
-/cfform-
@Haxtbh I had a similar issue with encrypt/decrypt after updating I got an error message but here is how I fixed it. Previously my code was
–cfset SecretHere = encrypt(TheStringHere, TheSecretKey, “AES”, “hex”)–
I changed it to
–cfset SecretHere = encrypt(“#TheStringHere#”, TheSecretKey, “AES”, “hex”)–
@Piyush – Thank you for the follow up.
Miguel,
You can find the details on the security vulnerability at:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0345
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0345
@Piyush:
Thanks for confirming!
[subscribe]
Dan,
That is correct. The last ColdFusion 10 update that carried any connector related changes was Update 14.
The CF10 Update 16 “Post Install” indicates the connectors do not need to be rebuilt if they’ve been rebuilt after Update 14.
Can we get a confirmation that the connector hasn’t changed for Apache since U14?
Thanks!
@haxtbh: Thanks; was just curious. Somewhere along the way, I’ve gotten in the habit of clearing the template and component caches after updating due to running into something like this on one of our production servers. I know it’s a bit of a performance hit but it has always felt safer.
@Ron
This was CF 11
@haxtbh: Did you encounter this on CF10 or CF11?
@Preethi
Thanks. That seems to have fixed it. Hopefully wont have to do this on all my deployments though!
Clearing the contents of {cfrootdir}/wwwroot/WEB-INF/cfclasses folder should take care of this. Please make a note to also restart the server. Let us know in case you still have an issue.
@haxtbh
Thanks for reporting this issue.
We are looking into it and will get back to you.
Getting a major issue when encrypting strings after installing this update. Gives the error
“Expected static method coldfusion.runtime.CFPage.Encrypt(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;”
when attempting to encrypt any string using different encryption types. Tried across two applications after installing the update, rerunning web server config and restarting CF services.
[subscribe]
Charlie, the WSConfig configurations are prompted for, and backed-up only on ColdFusion 11.
The fix will be available on ColdFusion 10 in a future release.
[subscribe]
Sorry, I said “cf11 update 6” in my last comment and of course I meant the one in this blog entry, update 5.
Also, I do see that the “bugs fixed” docs for CF11 does at least imply the change I highlighted, in the entry labelled, “WSConfig does not back up all the config files it changes.” That’s not in the CF10 “bigs fixed” guide.
Speaking of that, I’ve not yet had a chance to confirm if the updated prompt in the wsconfig UI is only in 11 and not 10. Anyone else know or notice it yet?
Good to see the update released in final form, guys.
I see already one nice improvement, not mentioned above, nor in the technote or “bugs fixed” page: the web server config tool (wsconfig) now warns us that removal of a connector will remove any customized settings/tweaks one may have made to that connector’s configuration. Thanks for that.
Also, for the information of readers here, if one does CF11 update 6, and then reconfigures the connectors (as one should), the isapi_redirect.dll will now be dated 3/11/2015.
[subscribe]
[subscribe]
I cannot find the reported vulnerability “CVE-2015-0345” to get further details.
Justin,
Can you please try force refreshing your browser,
and try checking for update again.
Thanks,
Piyush.
Yep, works now….thanks!
It’s fixed. Please check now and report back.
The update shows up now… Thanks Team CF!
Anit is aware of the issue with it not showing up in CFAdmin (make sure to follow him on Twitter: https://twitter.com/anitkumar85). It doesn’t show up if you’ve already got Update 4 installed, apparently. Perhaps try rolling back to update 3 first? I was able to install it OK from update 3.
—
Adam
[subscribe]
Same as Justin above… 😐
[subscribe]
[subscribe]
Ditto – it isn’t showing up as available.
CF Administrator does not find this update… yet…
My update site is set to: http://www.adobe.com/go/coldfusion-updates
(subscribing)
You must be logged in to post a comment.
23 Nov
10AM Pacific
Online
