The new updates are 1.8.0_321, (aka 8u321), 11.0.14, and 17.0.2, respectively).

For more on them, including information on the security fixes and bug fixes they each contain, see the Oracle resources I list below, as well as some additional info I offer for if you may be skipping to this from a JVM update from before Apr 2021, as well as info for Adobe ColdFusion users on where to find the updated Java versions, what JVM versions Adobe CF supports, and more.

Finding more info on these Jan 2022 Java updates

First, see the technotes for each of 1.8.0_321, 11.0.14, and 17.0.2.

Second, see the Java security fixes in these Jan 2022 updates, and a more elaborated discussion of these Java security issues . Both those documents cover all Oracle products, but I have linked to the Java-specific sections of the pages.

(And note that in both pages, they indicate that the vulnerability addressed by the security fix for this Java version, "applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs." It's not clear to me how to read this relative to the use of Java as underlying ColdFusion.)

Finally, see the listing of specific bug fixes in each update, as offered in a link at the bottom of those update technotes for each release above.

If you are not using Adobe ColdFusion, you can skip the next section.

News for my CF audience (you CAN get the Java updates from Adobe now, you should NOT for now use Java 17)

Since the focus of my blog and work is indeed mostly focused on those using Adobe ColdFusion, I will clarify for them that:

• The Adobe downloads page does indeed already have the downloads today for Java 11.0.14 and 1.8.0_321. Thanks for that quick response, Adobe! (In the past, it's taken days or even weeks, causing a lot of confusion and heartburn.)
• If you use Pete Freitag's wonderful HackmyCF service, he too has already updated his service to detect if you are not yet running the updated versions of either Java 8 or 11. You can expect a notification warning you about that soon, if you have not already gotten one. Pete's good like that!
• While Java 17 is indeed a new long-term support release for Java, so too are Java 8 and 11 still LTS releases. And ColdFusion 2021 and 2018 (the currently supported CF versions) do NOT yet support Java 17. They only support Java 11. (While CF2018 did support Java 12 for a time, that version lived only for 6 months, like all version between 11 and 17, so Adobe did not "keep up" with all those short-term versions.) We can expect a coming update to CF 2021 (and hopefully 2018) to add support for Java 17, as has been the pattern in the past.
• If it may help you, see a past blog post I've done with a table of what CF versions formally support what Oracle Java versions.
• And in a post I did on the Apr 2019 jvm updates (which I point to in that "table" post), I cover such things as how CF only formally supports Oracle Java and not others, the short-lived Java 12 support, and more.
• And if you are on older, unsupported versions of CF (CF2016 or earlier) or Java (older updates to Java 11 or 8, or Java 7 or earlier), you are playing a dangerous game of Russian Roulette. You may not have been struck yet, but just months ago I shared a post about a nasty ransomware vulnerability hitting those who had failed to update CF with a fix Adobe provided 10 years ago!. Even CF2016, last updated in March 2021, does not have security fixes in the updates for CF2018 and 2021 that Adobe released in Sept 2021, and any beyond.
• Finally, how do you go about updating Java within CF? I have various other resources I have created (blog posts, presentations). I list several of them related to updating CF and the JVM at my cfupdate page. I can also offer direct remote consulting help.

Should you apply the update? how soon?

This and the next section apply whether you may be using CF or not. Each org has to decide for themselves if the security fixes bug fixes, and any feature changes are of concern for them. Some folks/orgs tend to wait for some period of time to "let others be the guinea pigs", while others are concerned about security and so apply any new update with security fixes right away.

Of course, the best approach is to try things in a testing environment first, but many eschew that (for any of many reasons, at their peril). Even then, of course some problems don't show themselves in testing but only in production.

As noted in the security page above, even if you may not think you "need the changes in this update", do beware that you would be vulnerable to problems fixed in PREVIOUS updates. So it's always best to be on the latest update to the JVM version (like Java 8 or 11) you're using, as soon as possible.

Beware a change in the April 2021 JVM update, if you may be skipping over it

Finally, I want to point out that if you may be moving to this JVM update from an older one from before the JVM updates released in April 2021 (Java 11.0.11 and 1.8.0_291, respectively), do note that when you apply this update you will therefore inherit a rather important change that was introduced in those updates (and which remains, after them.)

Briefly, Java now no longer supports calling out (via https/tls) to servers that don't support at least TLS 1.2 or above. If you may be calling out to servers (via cfhttp or Java's httpclient, or via configuration of the CF Admin pointing to database servers, mail server, ldap servers, and the like), such requests will break upon applying those or later JVM updates, if those servers don't yet support at least TLS 1.2 or above.

Of course, you may not be responsible for and may have no control over those other servers you're calling out to, so you may prefer to tell Java to allow you to keep calling out to those for now. You can do that, via a simple one-line configuration change in a Java configuration file (not JVM args). More in a moment. That said, you are removing a protection that Oracle thinks is in your interest (modern browsers do also warn or even reject attempts to access servers via https if they don't support at least TLS 1.2 or above. This change is about how Java itself reacts to them.)

For more on this Java security change, and that configuration change needed to "undo it", see my post from April 2021 on those JVM updates released then.

Again, for direct help on any of these, I can offer remote screenshare consulting, and am usually able to quickly fix problems that might take many folks hours to resolve them (if they don't deal with these issues daily like I do, helping people). Or of course, comments and questions are welcome below.

For more content like this from Charlie Arehart:

• Signup to get his blog posts by email:
• Follow his blog RSS feed
• View the rest of his blog posts
• View his blog posts on the Adobe CF portal

Need more help with problems?

• If you may prefer direct help, rather than digging around here/elsewhere or via comments, he can help via his online consulting services
• See that page for more on how he can help a) over the web, safely and securely, b) usually very quickly, c) teaching you along the way, and d) with satisfaction guaranteed