August 17, 2023
RELEASED- ColdFusion 2023 and 2021 August 17th, 2023 Updates
Comments
(1)
August 17, 2023
RELEASED- ColdFusion 2023 and 2021 August 17th, 2023 Updates
I am working with ColdFusion Support team.
Staff 15 posts
Followers: 13 people
(1)
We are pleased to announce the availability of ColdFusion (2023 release) Update 4 and ColdFusion (2021 release) Update 10. These updates introduce the ColdFusion serial filter that can be used to allow or disallow Java classes or packages for the deserialization of Wddx packets.

What is the ColdFusion serial filter?

The cfserialfilter.txt file ensures protection against insecure Wddx deserialization attacks. On the other hand, the already existing serialfilter.txt blocks Java deserialization by disallowing certain Java classes or packages.

How do I download the updates?

Head over to the update pages to download the updates:

What do these updates contain?

Learn more about these updates from the following tech notes:

What else?

  • Docker images for ColdFusion 2021 and 2023 will be pushed to AWS ECR and Docker Hub shortly.
  • CFFiddle will be updated with ColdFusion 2021 Update 10 and ColdFusion 2023 Update 4 shortly.
Please install these updates and provide us with your feedback.
1 Comment
2023-08-17 15:29:34
2023-08-17 15:29:34

A couple of thoughts for readers: while this update doesn’t link to any Adobe product security bulletin (apsb, it is indeed a very important security update, offering a more complete resolution to some of the vulns addressed in the 3 CF security updates last month. For more details, see the update technote linked to above, especially how you can modify things related to the new protection. Thanks for trying to better address the issues here, Adobe. (Time will tell how things go for folks, of course.)

Also, sadly for those using cf2018, its end of life was last month, so it seems this update will not be made available to them. Another reason to consider moving up to cf2023, the only version currently sold by Adobe.

Finally, I noticed earlier today (until minutes before posting this comment) that today’s update was not showing up in my CF Admin. Indeed, I checked and the feed URL did not yet have today’s update. But it does now, for me at least. This could have do with caching anywhere between our own computers and Adobe–so if you may find it’s “not there” for you either, just be patient. Or as the technotes offer, you COULD download and apply the update manually.

Like
Add Comment