ColdFusion (2021 release) Update 2 (release date, 14 September, 2021) addresses vulnerabilities that are mentioned in the security bulletin, APSB21-75, and features the following:

• Licensing and activation changes.
  
• AWS Lambda package.
• cfsetup updates.
• Support for macOS Big Sur (v11.0) and Tomcat 9.0.50.

Note: The ColdFusion 2021 installers have also been refreshed with this update. The new server installers bundle Update 2 and JDK 11.0.11. The ColdFusion Add-Ons and other installers are bundled with JDK 11.0.11. The refreshed installers are available at ColdFusion downloads.

Licensing and activation changes

Usage data

Send usage data to Adobe ColdFusion licensing servers. For more information, see ColdFusion licensing and activation.

Auto restart instances

Enable if you want the instances to be automatically restarted after activation, deactivation, or changing usage data settings.

ColdFusion AWS Lambda Package

With AWS Lambda package in ColdFusion, you can now invoke cloud based AWS Lambda functions from ColdFusion server. For more information, see get started with ColdFusion AWS Lambda.

For more information, see get started with ColdFusion AWS Lambda.

GUI-based installer changes

The ColdFusion (2021 installer) no longer contains weinre. The change applies to all supported platforms. As a workaround, follow the steps below to setup a local Node server and remote Weinre server:

1. Install nodejs and weinre.
2. Download weinre zip and rename it as "node". Copy the file in ColdFusion2021/cfusion.
3. Platform-specific steps:

• Non windows: Create a folder called "weinre" inside node and place all the content of "node" folder inside weinre.
• Windows: Create a folder called "node-module" inside node and weinre inside "node-module",  and copy all the content of "node" folder inside weinre.

CFsetup updates

In Update 2, CFsetup includes the following changes:

1. Add and manage users. Users can also be granted access to roles and sandboxes.
   
2. Add or remove sandbox, set security, block IPs, grant runtime permissions, or block operations.

For more information, see CFsetup configuration tool.

Bugs fixed in this release

Known issues in this release

1. You are unable to start/stop an instance from the ColdFusion Administrator. As a workaround, ensure that the jvm.config file at <cfroot>/cfusion/bin does not have the -Xdebug java argument configured.
2. On macOS Big Sur, if you start Apache after configuring a connector, you see a warning message, "No code signing authority for module at /private/etc/apache2/mod_jk.so specified in LoadModule directive. Proceeding with loading process, but this will be an error condition in a future version of macOS."
3. If you do not have internet access, then on using the REPL mode, you may see a few license-connectivity related logs.
   
4. CFM applications that render text encounter an error related to libfontmanager. Oracle JDK-11.0.10 and later for Solaris 11 requires the OS to provide the text shaping library package, Harfbuzz. Release Notes | Download package.
   
5. When the multicast port is busy in your environment, there will be errors in logs after restarting the instances that are part of a cluster. To resolve the issue, in the ColdFusion Admin, change the multicast port in the Cluster Manager page.
   
6. When applying this update from Update 2 of ColdFusion 2021 through the Administrator, at present, there is no option to select the instances. All the instances will be updated.
   
7. Connecting to a MySQL database fails for AWS MySQLon Oracle JRE. After verifying the connection, an error message displays. The issue occurs because the MySQL JDBC driver is unable to connect to SSL over TLS. As of MySQL 5.7.35, as the TLSv1 and TLSv1.1 connection protocols are deprecated. As a workaround, add the parameter enabledTLSProtocols to the jdbc url.
   
8. Oracle Java in ColdFusion installers have TLS 1.0 and 1.1 disabled. TLS 1.0 and 1.1 have been deprecated and have been replaced with TLS 1.2 and 1.3. By default, the older versions of TLS are disabled in Java. These versions have now been disabled by default.
   
9. Same form fields are treated as arrays when used in Application.cfc. The fields are not part of any UDF or eventhandlers of Application.cfc, even when you set or do not set the flag this.sameformfieldsasarray.
   
10. The ColdFusion installer does not pick a new port for cfstatport, if already in use. As a workaround, update the cfstatport value in <cfroot>/lib/neo-metric.xml to 7991 and restart the server.
11. On a non-Windows platform, while sending message with WebSocket Proxy, if the message contains semi-colons, you must refresh the browser before viewing the message.
    
12. If you are installing ColdFusion on macOS, you may encounter issues. As a workaround, before launching the installer, run xattr -rc against the dmg.
13. When storing a result set in a ColdFusion scope (like local or arguments) and then attempting to run a query of queries on that result set, ColdFusion 2021 produces an error.
    

Prerequisites

1. On 64-bit computers, use 64-bit JRE for 64-bit ColdFusion.
2. If the ColdFusion server is behind a proxy, specify the proxy settings for the server to get the update notification and download the updates. Specify proxy settings using the system properties below in the jvm.config for a stand-alone installation, or corresponding script file for JEE installation.
   • http.proxyHost
   • http.proxyPort
   • http.proxyUser
   • http.proxyPassword
3. For ColdFusion running on JEE application servers, stop all application server instances before installing the update.

Installation

ColdFusion Administrator

In Package Manager > Packages, click Check for Updates in Core Server.

After it detects an update, click Update. The core package gets updated the the latest update.

All installed packages also get updated.

Restart ColdFusion for the changes to take effect.

Install the update in offline mode manually

1. Download the hotfix installer and repository from the link.
2. Unzip to a place where it can be accessed by all ColdFusion server instances.
3. Update "packagesurl" in cfusion/lib/neo_updates.xml of cfusion and all its child instances to point to <InstallerReposityUnzippedPath>/bundles/bundlesdependency.json present inside the downloaded folder.

If the core server hotfix installation is successful and if there are errors  or issues with packages, packages can be installed/updated from the package manager client(cfusion\bin\cfpm.bat|cfpm.sh).

You must have privileges to start or stop ColdFusion service and full access to the ColdFusion root directory.

• Windows: <cf_root>\jre\bin\java.exe -jar <InstallerReposityUnzippedPath>\bundles\updateinstallers\hotfix-002-328618.jar
  
• Linux-based platforms: <cf_root>/jre/bin/java -jar  <InstallerReposityUnzippedPath>/bundles/updateinstallers/hotfix-002-328618.jar

Ensure that the JRE bundled with ColdFusion is used for executing the downloaded JAR. For standalone ColdFusion, this must be at, <cf_root>/jre/bin.

Install the update from a user account that has permissions to restart ColdFusion services and other configured webservers .

For further details on how to manually update the application, see the help article.

After applying the update, you must upgrade the existing web server connectors.

Post installation

Uninstallation

To uninstall the update, perform one of the following:

• In ColdFusion Administrator, click Uninstall in Server Update > Updates > Installed Updates.
• Run the uninstaller for the update from the command prompt. For example, java -jar {cf_install_home}/{instance_home}/hf_updates/hf-2021-00002-328618/uninstall /uninstaller.jar

If you can't uninstall the update using the above-mentioned uninstall options, the uninstaller could be corrupted. However, you can manually uninstall the update by doing the following:

1. Delete the update jar from {cf_install_home}/{instance_name}/lib/updates.
2. Copy all folders from {cf_install_home}/{instance_name}/hf-updates/{hf-2021-00002-328618}/backup directory to {cf_install_home}/{instance_name}/