Update time already? <https://helpx.adobe.com/sec...
# adobej
Jim Priest
05/13/2025, 6:37 PMUpdate time already? https://helpx.adobe.com/security/products/coldfusion/apsb25-52.html
k
Ken Wilson
05/13/2025, 6:59 PMAny action required if you had previously installed the Update 14 preview release?
r
Rodney
05/13/2025, 7:06 PMYes, if you have scheduled tasks that output to a file or if you modified the default pathfilter.txt (now pathfilter.json) file.
Rodney
05/13/2025, 7:08 PMAlso, remote methods MUST have all arguments in the function declaration. That's going to break some of my DataTables.
c
Chad Norris
05/13/2025, 7:14 PMDoes anyone know if the argument declaration change is related to one of the CVEs or is it an enhancement? I know the JVM argument can disable that.
r
Rodney
05/13/2025, 7:20 PMProbably a CVE. Definitely not an enhancement.
c
Chad Norris
05/13/2025, 7:27 PM@Rodney......great. I am in the same boat as you unfortunately, at least we have the JVM argument so we can deploy the patch and then modify code.
Chad Norris
05/13/2025, 7:35 PM@Mark Takata (Adobe) is this a priority 1 or a priority 3 update? I have seen references to both. On the APSB it shows priority 1, but on the emailer that went out today it says priority 3.
d
Dave Merrill
05/13/2025, 7:36 PMThat arg change isn't super clear in the release notes either.
Dave Merrill
05/13/2025, 7:36 PMAll it says is that there's a new jvm arg -Dcoldfusion.runtime.remotemethod.matchArguments
r
Rodney
05/13/2025, 7:46 PMRemote methods must declare all expected arguments that will be passed into it. No more declaring 2 arguments, but passing in a variable amount of arguments that exceeds the 2 that are declared.
d
Dave Merrill
05/13/2025, 7:50 PMYeah found it, it's cf2025 only, which is why I didn't see it right off.
m
Mark Takata (Adobe)
05/13/2025, 8:03 PM@Chad Norris it is a P1, I believe the email was incorrect.
d
Dave Merrill
05/14/2025, 11:46 AM@Mark Takata (Adobe) and everyone, is it your understanding that the args being required for remote methods change is in CF 2025 only, not 2021 or 2023?
If so, does that mean those earlier releases are still vulnerable to the isssue(s) it fixes?
Dave Merrill
05/14/2025, 1:06 PMThe related jvm arg is documented for all 3 releases, this one:
-Dcoldfusion.runtime.remotemethod.matchArguments
I haven't had a chance to test this myself, but it'd be really good to have an official statement from Adobe and/or @Mark Takata (Adobe) about how this is implemented across all those releases.
Dave Merrill
05/14/2025, 1:33 PMJust to say it, it'd be weird for that jvm arg to be in all 3 releases if the related behavior change isn't.
c
Chris
05/14/2025, 2:07 PMAfter the update for CF2023 we started getting this with CFPDF: java.lang.ClassNotFoundException: coldfusion.image.Image not found by pdf [30]
Downgrade/upgrade of the PDF package resolved it.
d
Dave Merrill
05/14/2025, 2:24 PMIt'd also be weird to document a pretty major behavior change on only 1 of the 3 releases it applied to.
Dave Merrill
05/16/2025, 7:20 PMHas anyone implemented schedulerexecutionpaths in pathfilter.json?
Are those supposed to be full disk paths, eg H:/asdf/qwer.txt?
Do you have to restart the service for it to take effect?
Dave Merrill
05/16/2025, 7:45 PMNevermind, it's straightforward, but you do have to restart the service for it to take effect.
Dave Merrill
05/17/2025, 11:46 AMIs anyone seeing any breaking changes in CF 2021 update 20 besides the following:
• CFC methods with access="remote" must declare all arguments that are ever passed in the method signature. Note that this applies to all methods with remote access enabled, regardless of whether the call is actually remote.
• Scheduled tasks that use Publish > Save output to a file must have that path listed in in the schedulerexecutionpaths section of pathfilter.json
• Some issues with the PDF service
Anything else?
3 Views