TLDR: The new updates are 1.8.0_361 (aka 8u361), 11.0.18, 17.0.6, and 19.0.2 respectively). For more on each of them, including what changed and the security fixes they each contain (including their CVE scores regarding urgency of concerns), see the Oracle resources I list below. Oracle calls them "critical patch updates" (yep, CPU), but they are in fact scheduled quarterly updates, so that "critical" nomenclature may be a bit overstated. And as is generally the case with these Java updates, most of them have the same changes and fixes as each other, though not always.

Update: After posting this, I learned of some rather surprising implications of a new feature of the new JDK installer, as 11.0.18 or 17.0.6 and later. For more, see another post I created.

For some folks, that's all they need to hear. For others, read on for topics like:

• Finding more info on these Jan 2023 Java updates
• What about other JVM distributions besides Oracle?
• News for my CF audience (getting the Java updates from Adobe or Oracle, how to update, why you should NOT for now use Java 17 with CF, etc)
• Should you apply the update? how soon?
• Beware a change in the Oct 22 JVM update regarding Java no longer trusting jars signed with SHA-1
• Beware a change in the April 2021 JVM update, if you may be skipping over it
• Wrapping up, getting more help

Finding more info on these Jan 2023 Java updates

First, as for what changed in the updates, see the technotes for each of 1.8.0_361, 11.0.18, and 17.0.6, and 19.0.2. Some changes may be in all versions, while other changes may be only in a specific version/s. You should look carefully at the note for the version YOU are running.

Second, regarding security fixes included, see the Java security fixes in these Jan 2023 updates or Text Form of Risk Matrix for Oracle Java SE. And as always, see the "notes" offered for each vulnerability, as that may temper the severity. (Note that both those documents cover all Oracle products, but I have linked to the Java-specific sections of the pages.)

Third, see the listing of specific bug fixes included in each update, as offered in a link at the bottom of those update technotes for each release above.

As for obtaining the Java downloads, you can find all the current versions on this one page. But do note that while the top of the page offers the LATEST Java versions (Java 17 and above), you will find Java 11 and 8 offered later down the page. And while you DO need to sign in there to obtain the download files, an account is free.

(As I discuss below, the Adobe ColdFusion team also provides Java downloads for the versions they support.)

What about other JVM distributions besides Oracle?

Before moving on, I want to acknowledge that of course I do realize there are other distributions of Java besides Oracles, from the OpenJDK to alternatives from Azul, Amazon, Microsoft, and others.

While SOME of what I share in my jvm update notes, like this one, may well apply to those other distributions, I choose here to focus specifically on the Oracle JVM, because that's what's supported by the primary community I support, users of Adobe ColdFusion. (And while users of the open source Lucee CFML engine MAY choose to use Oracle's JVM, they are free to use other implementations.) Adobe licenses Oracle Java for use by ColdFusion users.

(Before leaving this subject, I should note that some may be interested to hear that Oracle announced in Sep 2021 that Java 17 and above would again be free for commercial use. See the page and FAQ offered there for more specifics. And CF users, see the next section on the state of support in CF for Java 17.)

In any case, if you are not using Adobe ColdFusion, you can skip the next section. The subsequent section picks up here.

News for my CF audience

Since the focus of my blog and work is indeed mostly focused on those using Adobe ColdFusion, I will clarify for them that:

• Adobe also offers the Java downloads, so that CF users need not log into the Oracle site, as discussed above. Sometimes Adobe gets these posted as soon as Oracle releases them, but often it may take some days.
• The Adobe downloads page for CF-related installers DOES now have the updated Java downloads in its bottom section. (It did not have them when I wrote this post, so this is an update to that.)
• Whereas prior to May 2022, Adobe offered a drop-down of the JVM versions at the bottom of that page, now they just list each version on its own, which is nice. (The drop-down was often out of order or not fully updated.)
• And while some assert that CF folks "must use those from the CF downloads page", every time I've done a binary compare of the files, they have been identical (at least for the identical build number, which may change slightly over time on the Oracle site though not the Adobe site). As this installer includes the Java license, I can't see how anyone could assert that it matters WHERE you get an identical installer.

As for keeping posted on updates, as a CFer (other than my blog posts or news shared from others), note that if you use Pete Freitag's wonderful HackmyCF service, he generally gets it updated within the day or two of the release of a new JVM version, warning if you are not running that latest supported Java version for your given CF version.

As for keeping track of what CF versions support what Java versions:

• See first a past blog post I've done with a table of what CF versions formally support what Oracle Java versions.
• While Java 17 is indeed a new long-term support release for Java, so too are Java 8 and 11 still LTS releases. And ColdFusion 2021 and 2018 (the currently supported CF versions) do NOT yet support Java 17. They only support Java 11. (CF2018 did originally come with Java 10, and it did support Java 12 for a time, but that version lived only for 6 months, like all version between 11 and 17, so Adobe did not "keep up" with all those short-term versions.) We can expect the coming CF2023 and perhaps an update to CF 2021 (even if not CF2018) to add support for Java 17, as has been the pattern in the past.
• As for Java 19 and the coming Java 20, those are short-term updates (like updates 12-16 had been), and I don't expect Adobe to support it . As for the next LTS release, Java 21, we'll cross that bridge when we get there in summary 2023.
• And in a post I did on the Apr 2019 jvm updates (which I point to in that "table" post), I cover such things as how CF only formally supports Oracle Java and not others, the short-lived Java 12 support, and more.
• Before moving on, let me note that if you ARE on an older, unsupported versions of CF (CF2016 or earlier) or Java (older updates to Java 11 or 8, or Java 7 or earlier), you're playing a dangerous game of Russian Roulette. You may not have been struck yet, but in Oct 2021 I offered a post about a nasty ransomware vulnerability hitting those who had failed to update CF with a fix Adobe had provided years ago! Even CF2016, last updated in March 2021, does not have security fixes in the updates for CF2018 and 2021 that Adobe released in Sept 2021, and any beyond. Don't be "that person", still running such older CF versions.

As for how you would go about updating Java within CF:

• There are varying steps depending on how you installed CF (or Lucee, where it also depends on whether you're running it on Tomcat as a service), and so on
• I'll note that if you're using Commandbox, it can update the JVM automatically if you like)
• Otherwise, I have various resources I've created (blog posts, presentations) discussing especially updating CF and the JVM within CF, and these are covered at my cfupdate page.

I can also offer direct remote consulting help. See the bottom section here.

Should you apply the update? how soon?

(This and the remaining sections apply whether one may be using CF or not.)

As whether you "should" apply this JVM update (going from some earlier point release of a given version to another), of course each org has to decide for themselves whether the security fixes bug fixes, and any feature changes are of concern for them. Some folks/orgs tend to wait for some period of time to "let others be the guinea pigs", while others are concerned about security and so apply any new update with security fixes right away.

Of course, the best approach is to try things in a testing environment first, but many eschew that (for any of many reasons, at their peril). Even then, of course some problems don't show themselves in testing but only in production.

As noted in the security discussion above, even if you may not think you "need the changes in this update", do beware that you would be vulnerable also to problems fixed in PREVIOUS updates, that you've not yet applied. So it's always best to be on the latest update to the JVM version (like Java 8 or 11) that you're using, as soon as possible.

I'll ads that the Oracle security technotes above speak of how the fixes included in this update address vulns in the immediately preceding point release, which could mislead some. They may think, "oh, well since I am not ON that immediately preceding update, then I don't need this update!". No, no, no. You'd really need to look at the technotes for THAT preceding point release and so on--all the preceding ones, back to the point release you ARE now running--to decide if these updates to that version "affect you". But really, for most people, they should just stay updated, for the sake of ensuring they have all the latest security updates and bug fixes.

As for whether there are any "issues" arising out of the new update, only time will tell, as more and more implement it, and share their experiences, whether in the community, or below or to me directly. If I learn of anything significant, I may create a new blog post and link to it here.

Beware a change in the Oct 22 JVM update regarding Java no longer trusting jars signed with SHA-1

Along those lines I want to point out that if you may be moving to this JVM update from an older one from before the JVM updates released in Oct 2022 (Java 11.0.17 and 1.8.0_351, respectively), do note that when you apply this update you will therefore inherit a rather important change that was introduced in those updates (and which remains, after them.)

As discussed in the release notes, from this point forward Java would no longer trust jars signed with SHA-1, if created since 2019. For more on this Java security change--and an available configuration change to "undo that protection" if needed, see my post from Oct 2022 on those JVM updates released then.

Beware a change in the April 2021 JVM update, if you may be skipping over it

And as well, if you may be moving to this JVM update from an older one from before the JVM updates released in April 2021 (Java 11.0.11 and 1.8.0_291, respectively), that had another rather important change you would inheret.

Briefly, Java now no longer supports calling out (via https/tls) to servers that don't support at least TLS 1.2 or above. If you may be calling out to servers (via cfhttp or Java's httpclient, or via configuration of the CF Admin pointing to database servers, mail server, ldap servers, and the like), such requests will break upon applying those or later JVM updates, if those servers don't yet support at least TLS 1.2 or above.

Of course, you may not be responsible for and may have no control over those other servers you're calling out to, so you may prefer to tell Java to allow you to keep calling out to those for now. You can do that, via a simple one-line configuration change in a Java configuration file (not JVM args). More in a moment. That said, you are removing a protection that Oracle thinks is in your interest (modern browsers do also warn or even reject attempts to access servers via https if they don't support at least TLS 1.2 or above. This change is about how Java itself reacts to them.)

For more on this Java security change, and that configuration change needed to "undo it", see my post from April 2021 on those JVM updates released then.

Wrapping up, getting more help

Again, for direct help on any of these, I can offer remote screenshare consulting help and am usually able to quickly fix problems that might take many folks hours to resolve them (if they don't deal with these issues daily like I do, helping people). Or of course, comments and questions are welcome below.

For more content like this from Charlie Arehart:

• Signup to get his blog posts by email:
• Follow his blog RSS feed
• View the rest of his blog posts
• View his blog posts on the Adobe CF portal

Need more help with problems?

• If you may prefer direct help, rather than digging around here/elsewhere or via comments, he can help via his online consulting services
• See that page for more on how he can help a) over the web, safely and securely, b) usually very quickly, c) teaching you along the way, and d) with satisfaction guaranteed