ColdFusion (2021 release) Update 5
What's new and changed
ColdFusion (2021 release) Update 5 (release date, 11 October 2022) addresses vulnerabilities that are mentioned in the security bulletin APSB22-44.
This release also includes support for macOS M1 and macOS 12 (Monterey).
Other changes
LOG FILES PAGE IN COLDFUSION ADMINISTRATOR
In the list of log files, the buttons to View, Download, and Delete a log file have been removed. Also, the log files are no longer clickable.
CHANGE IN XML
If the XML path contains a forward slash or backslash, it will be blocked. The flag, coldfusion.xml.allowPathCharacters, must be set to true to allow the same.
Bugs fixed in this release
| Bug ID | Description | Area |
| CF-4213363 |
When connections to the ColdFusion licensing site fails, in some cases, Enterprise versions revert to Developer versions. | Licensing |
| CF-4212745 |
cfdocument fails to embed registered fonts in PDF files, resulting in a PDF with the default font. | Document |
| CF-4212741 |
In some cases, you are unable to activate the license of a ColdFusion instance, which is running on AWS. |
Licensing |
| CF-4212727 |
On Oracle 19c, after you create a datasource, and add a cfc and a cfm in the same folder, on execution, you see an error related to incompatible type error for coldfusion.runtime.Struct. |
Language |
| CF-4212714 |
Issues with UUID after creating a container on Azure. You may see invalid values after the license request is successful. | Licensing |
| CF-4212713 |
In a container on AWS, in some cases, cgroup does not evaluate as expected. | Licensing |
| CF-4212674 |
The cfLicense.json file gets incorrectly created in JEE/bin instead of cfusion.war/WEB-INF/cfusion/bin/. |
Licensing |
| CF-4212650 |
After installing ColdFusion 2021 using the zip installer, wsconfig throws an error when you select Apache2. | Installation |
| CF-4212497 |
After changing the default caching from Ehcache to Redis, there are issues with ColdFusion threads, and the heap consumes a lot of memory. |
Caching |
| CF-4212384 |
In Update 2 of ColdFusion 2021, when including an ORDER BY clause in a QoQ and the column is referenced by an integer, a NullPointerException occurs. |
Database |
| CF-4212383 |
After applying ColdFusion 2021 Update 2, when using an ORDER BY clause in a QoQ, the fields in the ORDER BY clause becomes case sensitive, and a duplicate column gets added in the result. |
Database |
| CF-4212380 |
A QoQ containing the Union and Order by clauses throws an error, getColumnType() Null. |
Database |
| CF-4212349 |
If you create a pie chart and save it to a PDF, the chart does not display on an HTTPS site. |
Charting |
| CF-4212298 |
Unable to generate a PDF using cfdocument and cfhtmltopdf on a REST service. | Document |
| CF-4212127 |
There are intermittent errors when using cfhttp in apps or scheduled tasks. However, upon restarting ColdFusion, the issues get resolved. | Web services |
| CF-4211538 |
Temporary columns in an ORDER BY clause are randomly returned in a QoQ result, even if the columns are not specified in the SELECT statement. |
Database |
| CF-4210272 |
A clickable ITEMLABEL in cfchart does not work as expected after the update. It displays incorrect values in a png/jpeg output. | Charting |
| CF-4202730 |
In a query, when you select names with order, the order is incorrect in the result. |
Database |
| CF-4198201 |
In some cases, not all labels display as expected in a cfchart output. | Charting |
| CF-3844756 |
In a cfchart output, the bar in a stacked plot appears incorrectly. | Charting |
Known issues in this release
- On M1 macOS, after you enter ./cfsetup.sh in the console, an exception displays.
Prerequisites
- On 64-bit computers, use 64-bit JRE for 64-bit ColdFusion.
- If the ColdFusion server is behind a proxy, specify the proxy settings for the server to get the update notification and download the updates. Specify proxy settings using the system properties below in the jvm.config for a stand-alone installation, or corresponding script file for JEE installation.
- http.proxyHost
- http.proxyPort
- http.proxyUser
- http.proxyPassword
- For ColdFusion running on JEE application servers, stop all application server instances before installing the update.
Installation
ColdFusion Administrator
In Package Manager > Packages, click Check for Updates in Core Server.
After it detects an update, click Update. The core package gets updated with the latest update.
All installed packages that needs an update get updated.
Restart ColdFusion for the changes to take effect.
Install the update in offline mode manually
- Download the hotfix installer from the link.
- Unzip the repository to a place where it can be accessed by all ColdFusion server instances.
- Update "packagesurl" in cfusion/lib/neo_updates.xml of cfusion and all its child instances to point to <InstallerReposityUnzippedPath>/bundles/bundlesdependency.json present inside the downloaded folder.
If the core server hotfix installation is successful and if there are errors or issues with packages, packages can be installed/updated from the package manager client(cfusion\bin\cfpm.bat|cfpm.sh).
You must have privileges to start or stop ColdFusion service and full access to the ColdFusion root directory.
- Windows: <cf_root>\jre\bin\java.exe -jar <InstallerReposityUnzippedPath>\bundles\updateinstallers\hotfix-005-330109.jar
- Linux-based platforms: <cf_root>/jre/bin/java -jar <InstallerReposityUnzippedPath>/bundles/updateinstallers/hotfix-005-330109.jar
Ensure that the JRE bundled with ColdFusion is used for executing the downloaded JAR. For standalone ColdFusion, this must be at, <cf_root>/jre/bin.
Install the update from a user account that has permission to restart ColdFusion services and other configured webservers .
For further details on how to manually update the application, see the help article.
Updating the core package updates all the packages that were downloaded. Also, updating any package updates the core and rest of the packages. If ColdFusion (2021 release) is on Update 1, installing Update 5 via the admin of any instance updates the core for all other instances present.
Similarly, uninstalling the update from the same instance uninstalls the updates from instances that were updated together.
If you've created a mapping of the cf_scripts folder, you must copy the contents of the downloaded zip into CF_SCRIPTS/scrips/ajax folder to download the ajax package.
Post installation
After applying this update, the ColdFusion build number should be 2021.0.05.330109.
After applying this update, you must reinstall any custom hotfixes that might have been applied earlier. The hotfixes are located in the folder /ColdFusion2021/cfusion/hf-updates/hf-2021-00005-330109/backup/lib/updates.
Uninstallation
To uninstall the update, perform one of the following:
- In ColdFusion Administrator, click Uninstall in Server Update > Updates > Installed Updates.
- Run the uninstaller for the update from the command prompt. For example, java -jar {cf_install_home}/{instance_home}/hf_updates/hf-2021-00005-330109/uninstall /uninstaller.jar
If you can't uninstall the update using the above-mentioned uninstall options, the uninstaller could be corrupted. However, you can manually uninstall the update by doing the following:
- Delete the update jar from {cf_install_home}/{instance_name}/lib/updates.
- Copy all folders from {cf_install_home}/{instance_name}/hf-updates/{hf-2021-00005-330109}/backup directory to {cf_install_home}/{instance_name}/
Document history
| Date | Change |
| 10/27/2022 | Removed bug CF-4212391 from the list of issues fixed in the release. |