Do we know if Adobe is going to add Java 11.0.20 soon to the third party installers page?

Good question.... the security bulletin states: "Applying the ColdFusion update without a corresponding JDK update will NOT secure the server. See the relevant Tech Notes for more details."

I think this has been mentioned in the previous updates - but that should read something like "You should be running the latest available JDK for your version".

Yes, 💯 . In my case that was 11.0.20

Yeah - Adobe's messaging is confusing - is it Oracle's latest - or Adobe's latest version available? Maybe @Mark Takata (Adobe) could clarify.

I was under the impression that we are supposed to get updates from Adobe because of licensing issues

Yeah - and I'm not sure how support fits into that. Will Adobe provide support if you are using a newer version than the 'official' Adobe versions? Hopefully once these vulnerabilities are handled they can spend some time and address messaging, etc that have cropped up in all these updates.

@Mark Takata (Adobe) any idea when this will be updated?

Unless you are on a JEE install this is not needed. Following the instructions here will get you where you need to be: https://helpx.adobe.com/coldfusion/kb/coldfusion-2021-update-9.html

Not for this issue, but for the issues addressed in the new Java release.

And the answer for supporting "newer versions" is that we support the shipped versions OR the versions we have posted. If you are installing other versions that we have not regression tested, we cannot ensure they will work 100%

So the Java update is not required unless you are on a JEE install?

Sorry no you do need to update the JDK, but you don't need the JVM arguments. Apologies for the confusion on that.

Thanks for clarifying 👍🏼

@Mark Takata (Adobe) see my question above. When you say 'you do need to update the JDK' is that to the latest Adobe release or the latest Oracle release - they are often not the same.

Jim, the Adobe one. Per support: