A second priority 1 CF security update in one week, released Jul 14 2023

For more on the update, and some additional thoughts, read on.

Update: Just 5 days after this update, there was yet another P1 CF security update. I discuss that in this subsequent post, but you may still want to read this one for what I'd shared at the time of that post.

As with the last update (which I blogged about here), you can find the links to the specific updates (CF2023 update 2, CF2021 update 8, and CF2018 update 18) offered in the security bulletin., as well as in their blog post the same day about the update. (BTW, yes, for the first few hours after the release of the update, the security bulletin was getting a 404. One reason I held off posting this until that evening was to see and be able to assess that.)

Like the last one, this one also "resolves a critical vulnerability that could lead to arbitrary code execution." There no further detail that I know of.

And like the last one (the ones for CF2021 and 2023, specifically), those doing a manual offline install will notice that Adobe is offering only the jar, not the zip (holding a complete repo for use by the CFPM tool). FWIW, the CF2021 update 8 technote indicates this saying (rather confusingly) that "you need not download the bundle's folder,". And though the CF2023 update 2 technote doesn't make the same clarification, it seems clear the same point applies.

Something of interest to some readers is that this newer APSB security bulletin does at least change its wording about the need of a Java update to NOT refer to Java 17 (as in the previous bulletin, and discussed in my previous post). It now reads, "Adobe recommends updating your ColdFusion JDK/JRE LTS version to the latest update release".

I would recommend you read my post from earlier this week, as there are details I offered there which I do not repeat here.

Finally, as for CF2018, while the previous update this week was to be its LAST update (as its end-of-life date was in fact yesterday), it seems THIS update is now due to be its last.

Again, I'm afraid there's no further information I can offer than what's offered in Adobe's resources on this update. I'm just posting this for the sake of readers of my blog. (Some people may not log into the admin or setup any of various ways to be otherwise notified when an update is released.) But like the last one, if I learn anything interesting, I will update this post.

For more content like this from Charlie Arehart:

• Signup to get his blog posts by email:
• Follow his blog RSS feed
• View the rest of his blog posts
• View his blog posts on the Adobe CF portal

Need more help with problems?

• If you may prefer direct help, rather than digging around here/elsewhere or via comments, he can help via his online consulting services
• See that page for more on how he can help a) over the web, safely and securely, b) usually very quickly, c) teaching you along the way, and d) with satisfaction guaranteed