Announcing ColdFusion updates released June 11 2024: another possible breaking change
This is another important heads-up for my readers: there was an important security update released today by Adobe for ColdFusion 2023 (its update 8) and ColdFusion 2021 (its update 14). Just like the recent CF updates in March, this one again has a potential breaking change (trading away compatibility for the sake of security), and it adds yet another JVM arg that allows you to "revert" to the previous default behavior--to let you benefit from OTHER security aspects of the update, while you give time to addressing what should be changed.
In this case, it's about if you use CF encryption-related functions, the default encryption algorithm is changing--and that means that those who encrypt/decrypt (or hash or randomize) data in their apps MUST take steps before applying this updates. For more, read on.
Update: As a heads-up, a few weeks after this post ANNOUNCING the update and its key change, I created another that address confusion many still seem to have after reading the Adobe technote on the update (links below).You may want to skip to reading that post first, On handling the June 2024 CF update change of default algorithm from CFMX_COMPAT.Otherwise, read on for what I wrote originally.
So I've added an update to my post above about this.
And if you are the person who sent me word, please send it again. It was early in my day here at cfcamp in Germany, and I can't recall how you had sent it. I looked through several places before writing this! :-)
Error below:
errorError editing/creating this dsn (dsn-name)
An error occurred while trying to encrypt or decrypt your input string: Given final block not properly padded. Such issues can arise if a bad key is used during decryption..
local.result = encrypt(arguments.fromString, getKey(arguments.algorithm), local.algorithm, local.encoding );
However, that does not appear to be the case. The encryption actually works, but not without the "...error occurred while trying to encrypt or decrypt your input string: '' Can not decode string..." warning.
Has anyone else encountered this?
But more specifically, here is code that will demonstrate that things work if (as you propose) one DOES set the 3rd arg (for encrypt or decrypt) to "cfmx_compat", and this works whether you set the jvm arg true or false or if you leave it off. Notice how my code outputs whether that's so, as well as the CF version and update level.
<cfscript>
msg="test msg"
algo="cfmx_compat"
key="123"
writeoutput("Message to encrypt:" & msg & '<hr>')
encryptedMsg = encrypt(msg,key, algo)
decryptedMsg = decrypt(encryptedMsg,key, algo)
writeoutput("Decrypted message:" & decryptedMsg & "<hr>")
writeoutput("CF version: " & server.coldfusion.productversion & "<hr>")
writeOutput("JVM arg -Dcoldfusion.encryption.useCFMX_COMPATAsDefault")
if (not structKeyExists(server.system.properties,"coldfusion.encryption.useCFMX_COMPATAsDefault")) {
writeoutput(" <u>is not set</u>")
}
else {
writeoutput("=" & server.system.properties["coldfusion.encryption.useCFMX_COMPATAsDefault"])
}
</cfscript>
Please let us know how things go.