[Looking for Charlie's main web site? or all posts?]

Announcing ColdFusion updates released Nov 14 2023 - security update

Posted At : November 14, 2023 12:55 PM | Posted By : Charlie Arehart
Related Categories: updates, cf2021, admin, java, cf2023
Comments: (11)
Just a heads-up for my readers that there was an important security update released today by Adobe for ColdFusion 2023 (update 6) and 2021 (update 12). (Users of previous CF versions should note that those are no longer updated, not even for security fixes).

If you apply the update using the CF Admin and then find that CF starts but the Admin and your code fail, I cover that also, in the second section below.

For more, read on.

[....Continue Reading....]

Comments (11)
Comments
[Add Comment]
Hi Charlie, I just read your email about this and decided to update CF2023 to Update 6 and now I have a server-wide 500 Internal Server Error that I can't resolve.

The log says:

Installation: Unsuccessful.

145 Successes
2 Warnings
2 NonFatalErrors
2 FatalErrors

Action Notes:

Failed to copy hotfix files:C:\Users\Administrator\250372.tmp\dist\updates: Failed to copy the hotfix files to the target location. Retry installation after ensuring that the server is not running or files are not locked by the server.

Failed to copy hotfix files:C:\Users\Administrator\250372.tmp\dist\wwwroot: Failed to copy the hotfix files to the target location. Retry installation after ensuring that the server is not running or files are not locked by the server.

I have tried to uninstall using CMD and it says invalid or corrupt JAR file for the uninstaller.jar

I have reinstalled the update, several times, manually stopped all Coldfusion services before doing it and it's still stuck in this state.

I'm out of ideas of where to go from here - any help would be much appreciated.
# Posted By Jon Nicholson | 11/14/23 1:59 PM
You don't say whether you saw and heeded what I reported in the section, "What about the problem if you'd updated CF to use a Java version released since July?"

Perhaps you presumed it does not apply to you, but it sounds like it may (and I may rename that section to stand out better to folks who may misconstrue its importance).
# Posted By Charlie Arehart | 11/14/23 2:52 PM
Thanks for your reply Charlie. I did read your article but as I'm on the version of Java that I believed wasn't affected by it and it was supposed to be fixed for Update 6, I ignored it - my mistake.

I have now managed to install updated 5 with the extra argument and it went through ok. However, I now have a new problem that I can see in FusionReactor which is that it says 'java.lang.NoSuchFieldError: preserveCase'.

I can open the Administrator but Coldfusion is failing to process any application.cfc on my server because of it but I don't have any code that references preserveCase. I don't know if that's a Java problem or a corrupted Coldfusion file problem.
# Posted By Jon Nicholson | 11/14/23 3:08 PM
That's not an error I've heard of, no.

I'd start with clearing the cfclasses folder, if you know what that means. And I'd recommend you stop cf, rename that folder, then start cf. Not only will create the new cfclasses folder for you, but you'll have it for possible postmortem assessment--whether of this or other issues.
# Posted By Charlie Arehart | 11/14/23 3:12 PM
Thank you - you are a lifesaver. I did as you suggested and it has resolved the issue.

I wish Adobe support was as reactive and helpful.

Thanks again.
# Posted By Jon Nicholson | 11/14/23 3:20 PM
Great to hear, and really glad to have helped.

And you can help others here (since that seems a new problem): what cf update had you been on before update 6?
# Posted By Charlie Arehart | 11/14/23 3:24 PM
I was on Update 3. I hope it helps others too. Your other posts have certainly helped me many times previously over the years.
# Posted By Jon Nicholson | 11/14/23 3:33 PM
Thanks. I'll note that update 5 had done more than security fixes (unlike the four previous and this latest). I'm inclined to think that's where the problem was introduced, but again I'd not yet heard of it. Just offering this to others who may find and/or report the problem--or who may care to investigate things further.
# Posted By Charlie Arehart | 11/14/23 3:43 PM
I just want to second the statement that you are a lifesaver. I've gotten so much help from your blog regarding the security updates.
# Posted By S Daugherty | 11/15/23 9:42 AM
Just to inform you that I had the same "could not access a java object field called preserveCase" issue in CF2023, Update 5. The problem presented after we installed the "report" package from CF admin portal. We recreated the cfclasses folder and it worked again.
# Posted By Phil Alvrez | 1/17/24 9:43 AM
@Phil, thanks for the clarification that it seems related to the Report package/module . (FWIW, I had in fact proposed (in comment here on 11/14) that doing so was the seeming solution, and that it seemed to be an issue as of update 5.) Also, I have tweaked your comment. I'm pretty sure you meant to say cfclasses rather than class (a very important distinction).

@S Daugherty, thanks for your kind regards here. Sorry I missed that back in November.
# Posted By Charlie Arehart | 1/17/24 10:29 AM
[Add Comment]
Copyright ©2026 Charlie Arehart
Carehart Logo
BlogCFC was created by Raymond Camden. This blog is running version 5.005.
(Want to validate the HTML in this page?)

Managed Hosting Services provided by
xByte cloud Hosting