http://coldfusion.com logo
Join Slack
Powered by
Adobe Security Bulletin: APSB25-15 <https://helpx....
# adobe
m
Adobe Security Bulletin: APSB25-15 https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html Adobe has released security updates for ColdFusion versions 2025, 2023 and 2021. These updates resolve critical and important vulnerabilities that could lead to arbitrary file system read, arbitrary code execution and security feature bypass. Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates. * PLEASE READ THE ENTIRE BULLETIN AND BACK UP YOUR SERVERS PRIOR TO APPLYING *
👍 2
Updates which are part of this release: • ColdFusion 2025 Update 1 • ColdFusion 2023 Update 13 • ColdFusion 2021 Update 19 • ColdFusion 2025 Refreshed Add-on Server • ColdFusion 2023 Refreshed Add-on Server • ColdFusion 2021 Refreshed Add-on Server • ColdFusion 2025 Refreshed Lockdown Installer • ColdFusion 2023 Refreshed Lockdown Installer • ColdFusion 2021 Refreshed Lockdown Installer 30 security issues are addressed. • Docker Images for ColdFusion 2021, 2023 and 2025 will be pushed to AWS ECR & Docker Hub by tomorrow • CF Fiddle will be updated with the ColdFusion 2025 Update 1, ColdFusion 2023 Update 13 & ColdFusion 2021 Update 19 by tomorrow
HELPX KB Articles/Other links : CF 2025 Server Update 1 Tech Note https://helpx.adobe.com/coldfusion/kb/coldfusion-2025-update-1.html CF 2023 Server Update 13 Tech Note https://helpx.adobe.com/coldfusion/kb/coldfusion-2023-update-13.html CF 2021 Server Update 19 Tech Note https://helpx.adobe.com/coldfusion/kb/coldfusion-2021-update-19.html Community Forum Blogpost https://community.adobe.com/t5/coldfusion-discussions/now-live-coldfusion-2025-2023-and-2021-april-security-updates/m-p/15257870#M200650 Community Portal Blogpost https://coldfusion.adobe.com/2025/04/now-live-coldfusion-2025-2023-and-2021-april-security-updates/ CF2025 packages https://cfdownload.adobe.com/pub/adobe/coldfusion/2025/packages/hotfix-packages-cf2025-001-331420.zip CF2023 packages https://cfdownload.adobe.com/pub/adobe/coldfusion/2023/packages/hotfix-packages-cf2023-010-330680.zip CF 2021 packages https://cfdownload.adobe.com/pub/adobe/coldfusion/2021/packages/hotfix-packages-cf2021-016-330307.zip CF2025 Server Updates History https://helpx.adobe.com/coldfusion/kb/coldfusion-2025-updates.html CF2023 Server Updates History https://helpx.adobe.com/coldfusion/kb/coldfusion-2023-updates.html CF2021 Server Updates History https://helpx.adobe.com/coldfusion/kb/coldfusion-2021-updates.html
c
This update breaks jetty
on CF 2023
m
@Rochelle Hannah @priyank_adobe
p
@Mark Takata (Adobe) This is a security update and bugs will not be visible to users.
m
RIGHT. Sorry, forgot.
d
Anyone else seeing breakage?
Do we need to back up anything outside of <cfroot>cfusion etc?
c
All I can tell for now, I am uninstalling the update and attempting to get systems back online. The is from the service and just states "The ColdFusion 2023 Add-on Services service terminated unexpectedly." error only
d
Did you update using the admin UI, or on the cmd line. I've always found the cmd line to be way more reliable. That's all I've used for some a while now, not worth the aggravation to use the UI.
c
admin ui
d
let us know if you're able to get back running after the uninstall. if you are, try the cmd line install if you can.
@Mark Takata (Adobe) Re backing up... • Do we need to back up anything outside of cfrootcfusion etc? • Do we need to stop cf first? -- I assume we do, it's just that backing up is by far the most time consuming step in the update, meaning the server would be offline for a while.
c
It is something to do with the update to the start.ini file, if I comment out --module=ipaccess jetty will start
d
Is that line new, if you know?
c
it is a new line
everything else is the same, on the start.ini file except for that new argument
new on the left, old on the right
👍 1
s
It is related to this part in tech note: ColdFusion has introduced IP-based filtering on the Jetty side. View cfhtmltopdf for more information. It requires some configuration in jetty-ipaccess.xml. Can you try that once.
c
I think I figured it out, the update on CF2023 is not creating the jetty-ipaccess.xml file
I added that put the module back in on the start.ini and the service started
Sorry @Satyam Mishra I just saw your reply
c
What directory did you add that file to?
c
cf_root/cfusion/jetty/etc
c
s
cfusion/ColdFusionSolr/etc/jetty-ipaccess.xml This is the path. and sample file can be see from: https://helpx.adobe.com/coldfusion/cfml-reference/coldfusion-tags/tags-g-h/cfhtmltopdf.html Meantime, we will check why update is not able to place the file. Thanks @Chad Norris for pointing the issue
c
@Satyam Mishra is there an example as to how to add internal ip addresses to the jetty-ipaccess.xml file, or even an example of the file that the update is supposed to put there?
to be honest, with how many CVSS eights and nines are in this security patch, I don't want to wait for another version of the update
s
@Chad Norris The file is the complete structure in this location. https://helpx.adobe.com/coldfusion/cfml-reference/coldfusion-tags/tags-g-h/cfhtmltopdf.html Obviously the IPs need to be replaced.
l
Just verifying that we don’t need the new JVM arguments on a standalone installation?
c
@Satyam Mishra I assume if we wanted to only have our internal network access it something like this could work?
<Configure id="Server" class="org.eclipse.jetty.server.Server">
<Call name="insertHandler">
<Arg>
<New id="IPAccessHandler" class="org.eclipse.jetty.server.handler.IPAccessHandler">
<Set name="white">
<Array type="String">
<Item>10.0.0.0/16</Item>
</Array>
</Set>
<Set name="whiteListByPath">false</Set>
</New>
</Arg>
</Call>
</Configure>
👍 1
s
@Lisa Rees Jdk flags are applicable to all types of installations. Some of the changes in update might be breaking changes. Jvm flags are provided to restore backward compatibility.
👍 1
l
So this line isn’t entirely accurate, then “Set the JVM flags on a JEE installation of ColdFusion, not on a standalone installation.”
s
@Lisa Rees I was talking about New JVM flags in this update • -Dcoldfusion.cfencode.decryption.enable • -Dcoldfusion.pdfg.connectionTimeout • -Dcoldfusion.datasource.blocked.properties • -Dcoldfusion.compiler.block.bytecode That particular statement is specific to one above it.
k
@Satyam Mishra Where is the file we need to update for a standard CF2021 installation? Or do we just update the jvm.config java.args? I'm not seeing the Catalina file unless I am in the wrong location
c
@Satyam Mishra when attempting to use that configuration and being on a server within that subnet and when trying to go to localhost:8995/solr I am getting a 403 forbidden. Along with that, if I try to put in 127.0.0.1 the jetty config wont accept the Ip address.
s
@Keegan Donnelly jvm args can be added in jvm.config file. Forr JEE deployments we have different ways. @Chad Norris Please go through update doc, things should work. I assume we may not even require to add entry for localhost, it should be default whitelisted ip.Just try it. There is also an issue in 'Known Issue section' , check that too. Logging off as its late night for me. 🙂
👍 1
c
@Satyam Mishra I have gone through the update doc and the known issue section. The update is broken and using the example config information for the cfhtmltopdf doesn't work either. Even telling to white list everything using 0.0.0.0/0 prevents access to the jetty interface and the coldfusion administrator will not show solr collections.
🤔 1
To anyone having problems with jetty after the update creating the file cfusion/etc/jetty-ipaccess.xml with the following 
<Configure id="Server" class="org.eclipse.jetty.server.Server">
<Call name="insertHandler">
<Arg>
<New id="IPAccessHandler" class="org.eclipse.jetty.server.handler.IPAccessHandler">
<Set name="white">
<Array type="String">
<Item>127.0.0.1</Item>
</Array>
</Set>
<Set name="black">
<Array type="String">
<Item>0.0.0.0/0</Item>
</Array>
</Set>
<Set name="whiteListByPath">false</Set>
</New>
</Arg>
</Call>
</Configure>
❤️ 1
Worked for me, when I had my solr server and pdf services set to the default localhost configuration
d
@Mark Takata (Adobe) @priyank_adobe Sorry to bang on this, but it's important. Re backing up before running this update... • Do we need to back up anything outside of <cfroot>cfusion etc? • Do we need to stop cf first? -- Probably we do, it's just that backing up is by far the most time consuming step in the update, meaning the server would be offline for a while, not great for production servers.
SURVEY Do you clear the felix cache after updating CF? Always, or only if there's trouble?
r
Hi @Dave Merrill Clearing Felix cache is needed only if you encounter documentscope error while generating PDF
d
There are other problems we and others have seen that doing that fixed. But updating two 2021 servers, it looks like the update already did it, everything in that directory is dated as of the update.
p
Hi Dave, you can take the backup of entire ColdFusion folder.
d
OK, thank you.
Has anyone run into anything unexpected after installing this update, specifically the 2021 version, but really any version?
m
Just updated on commandbox so far locally. A lot of -Dcoldfusion.compiler.block.bytecode errors initially. Nothing would load on our site. A couple more restarts and it seemed to be working mostly better. However the CF Administrator still won't load now. I haven't set -Dcoldfusion.compiler.block.bytecode=true yet. Still reviewing what's going on.
d
So, is this update actually stable for CF2023? Or shall we wait till things have been ironed out
👀 1
d
^^^ Same question for CF2021.
d
@Mark Takata (Adobe) Could you confirm whether this update is stable for CF2023? Or shall we wait until things have been ironed out?
d
Knock silicon, I did two servers this week, smooth, no known issues since. Cmd line install, like I always do.
m
@davequested It's stable and solid for 23. Just make sure you read through the tech notes carefully, there's a few places you have to be careful on auth (things were being passed in less-than secure ways which now may require a bit of tweaking). The only places I've seen issues so far was with folks that missed details in the individual tech note (and apologies, yes there's a lot of them). Like DM said, CLI is usually the least problematic (but I use GUI and rarely have issues myself, so your mileage may vary).
d
PDF generation stuffed. I've copied the jetty-ipaccess.xml across into /etc from the /extra folder. The PDF service connects fine when verifying in the CFAdmin. PDFs no longer work. Just silently fails. No PDF generated using cfhtmltopdf. On ACF2023. What now?! I've gone through the tech notes top to bottom. Nothing. Complete disaster.
m
Dave, did you IP whitelist jetty as specified my Satyam earlier in this thread?
d
@Mark Takata (Adobe) @Satyam Mishra We have a single instance of ACF 2023 on Windows. We've put this into C:\ColdFusion2023\cfusion\jetty\etc\jetty-ipaccess.xml 
<?xml version="1.0"?>
<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "<http://www.eclipse.org/jetty/configure_9_3.dtd>">
<!-- =============================================================== -->
<!-- The IP Access Handler                                           -->
<!-- =============================================================== -->
<Configure id="Server" class="org.eclipse.jetty.server.Server">
<Call name="insertHandler">
<Arg>
<New id="IPAccessHandler" class="org.eclipse.jetty.server.handler.IPAccessHandler">
<Set name="white">
<Array type="String">
<Item>127.0.0.1</Item>
</Array>
</Set>
<Set name="black">
<Array type="String">
<Item>0.0.0.0/0</Item>
</Array>
</Set>
<Set name="whiteListByPath">false</Set>
</New>
</Arg>
</Call>
</Configure>
The PDF service is in CFAdmin as 127.0.0.1, port 8995. If we try and verify it, it says it can't be found and removes it. What am I missing?
@Chad Norris You had a lot of issues applying this update. We're having very similar issues to your early comments. We tried your jetty-ipaccess.xml that you pasted here, no joy. Was there anything else that you did to make it work?
c
@davequested Reading my previous message I had a typo in my path but it seems like you caught that and you have it in the right directory. The only difference I can see between mine and yours is everything above the Configure tag, I don't have any of that. The other thing is would have to restart the ColdFusion Add-On Services any time I made a change to that file.
d
Thanks @Chad Norris, I did try all those things suggested. At a total loss as to why it's not working for us. I've had to roll back to Update 12 as Update 13 just won't work for us. We rely heavily on cfhtmltopdf unfortunately. Really hoping Adobe can shed some light on what we're doing wrong, or release a further update which fixes things.
c
@davequested on the machine that you have your CF installed on, are you able to get to http://127.0.0.1:8995 and get a listing of three services?
s
@Kaushik L V Please look into this
k
Hey @davequested I wanted to know a couple of things - 1. After you applied the update, did you see any error related to registration of CF with the add-on service? If you did, then there would be a error message related to it in the exception.log. Can you share that? 2. Can you also check the size of the bcprov-jdk18on-1.78.1.jar present in your bundles/repo directory? I need to know if its 8130 KB or 8151 KB
d
There are different versions of that jar with the same version number?
k
No there should be only one bcprov-jdk18on-1.78.1.jar I need to know the size of that jar currently present
2 Views
Open in Slack
PreviousNext
Powered by