Jdk 8 High Sierra

admin

Force application glitches out of hiding with our Systems Management Bundle, and discover the issues lurking behind the application stack. Guarding against downtime. Download Free Trial. Java version '1.8.0161' Java(TM) SE Runtime Environment (build 1.8.0161-b12) Java HotSpot(TM) 64-Bit Server VM (build 25.161-b12, mixed mode) Conclusion Again, it seems pretty straight forward and it is but before some research it was still a little unclear.

Java™ SE Development Kit 8, Update 121 (JDK 8u121)

January 17, 2017

The full version string for this update release is 1.8.0_121-b13 (where 'b' means 'build'). The version number is 8u121.

IANA Data 2016i

JDK 8u121 contains IANA time zone data version 2016i. For more information, refer to Timezone Data Versions in the JRE Software.

Security Baselines

The security baselines for the Java Runtime Environment (JRE) at the time of the release of JDK 8u121 are specified in the following table:

JRE Family VersionJRE Security Baseline (Full Version String)
81.8.0_121-b13
71.7.0_131-b12
61.6.0_141-b12

JRE Expiration Date

The JRE expires whenever a new release with security vulnerability fixes becomes available. Critical patch updates, which contain security vulnerability fixes, are announced one year in advance on Critical Patch Updates, Security Alerts and Third Party Bulletin. This JRE (version 8u121) will expire with the release of the next critical patch update scheduled for April 18, 2017.

For systems unable to reach the Oracle Servers, a secondary mechanism expires this JRE (version 8u121) on May 18, 2017. After either condition is met (new release becoming available or expiration date reached), the JRE will provide additional warnings and reminders to users to update to the newer version. For more information, see JRE Expiration Date.

Notes

core-libs/javax.naming

Improved protection for JNDI remote class loading

Remote class loading via JNDI object factories stored in naming and directory services is disabled by default. To enable remote class loading by the RMI Registry or COS Naming service provider, set the following system property to the string 'true', as appropriate:

JDK-8158997 (not public)

security-libs/java.security

jarsigner -verbose -verify should print the algorithms used to sign the jar

The jarsigner tool has been enhanced to show details of the algorithms and keys used to generate a signed JAR file and will also provide an indication if any of them are considered weak.

Specifically, when 'jarsigner -verify -verbose filename.jar' is called, a separate section is printed out showing information of the signature and timestamp (if it exists) inside the signed JAR file, even if it is treated as unsigned for various reasons. If any algorithm or key used is considered weak, as specified in the Security property, jdk.jar.disabledAlgorithms, it will be labeled with '(weak)'.

For example:

See JDK-8163304

New Features

security-libs/javax.xml.crypto

Added security property to configure XML Signature secure validation mode

A new security property named jdk.xml.dsig.secureValidationPolicy has been added that allows you to configure the individual restrictions that are enforced when the secure validation mode of XML Signature is enabled. The default value for this property in the java.security configuration file is:

Please refer to the definition of the property in the java.security file for more information.

See JDK-8151893

core-libs/java.io:serialization

Serialization Filter Configuration

Serialization Filtering introduces a new mechanism which allows incoming streams of object-serialization data to be filtered in order to improve both security and robustness. Every ObjectInputStream applies a filter, if configured, to the stream contents during deserialization. Filters are set using either a system property or a configured security property. The value of the 'jdk.serialFilter' patterns are described in JEP 290 Serialization Filtering and in <JRE>/lib/security/java.security. Filter actions are logged to the 'java.io.serialization' logger, if enabled.

See JDK-8155760

core-libs/java.rmi

RMI Better constraint checking

RMI Registry and Distributed Garbage Collection use the mechanisms of JEP 290 Serialization Filtering to improve service robustness.

RMI Registry and DGC implement built-in white-list filters for the typical classes expected to be used with each service.

Additional filter patterns can be configured using either a system property or a security property. The 'sun.rmi.registry.registryFilter' and 'sun.rmi.transport.dgcFilter' property pattern syntax is described in JEP 290 and in <JRE>/lib/security/java.security.

JDK-8156802 (not public)

security-libs

Add mechanism to allow non-default root CAs to not be subject to algorithm restrictions

Jdk 8 High Sierra

*New certpath constraint: jdkCA*

In the java.security file, an additional constraint named 'jdkCA' is added to the jdk.certpath.disabledAlgorithms property. This constraint prohibits the specified algorithm only if the algorithm is used in a certificate chain that terminates at a marked trust anchor in the lib/security/cacerts keystore. If the jdkCA constraint is not set, then all chains using the specified algorithm are restricted. jdkCA may only be used once in a DisabledAlgorithm expression.

Example: To apply this constraint to SHA-1 certificates, include the following: SHA1 jdkCA

See JDK-8140422

Changes

security-libs/javax.net.ssl

Make 3DES as a legacy algorithm in the JSSE provider

For SSL/TLS/DTLS protocols, the security strength of 3DES cipher suites is not sufficient for persistent connections. By adding 3DES_EDE_CBC to the jdk.tls.legacyAlgorithms security property by default in JDK, 3DES cipher suites will not be negotiated unless there are no other candidates during the establishing of SSL/TLS/DTLS connections.

At their own risk, applications can update this restriction in the security property (jdk.tls.legacyAlgorithms) if 3DES cipher suites are really preferred.

JDK-8165071 (not public)

security-libs/javax.net.ssl

Improve the default strength of EC in JDK

To improve the default strength of EC cryptography, EC keys less than 224 bits have been deactivated in certification path processing (via the jdk.certpath.disabledAlgorithms Security Property) and SSL/TLS connections (via the jdk.tls.disabledAlgorithms Security Property) in JDK. Applications can update this restriction in the Security Properties and permit smaller key sizes if really needed (for example, 'EC keySize < 192'). EC curves less than 256 bits are removed from the SSL/TLS implementation in JDK. The new System Property, jdk.tls.namedGroups, defines a list of enabled named curves for EC cipher suites in order of preference. If an application needs to customize the default enabled EC curves or the curves preference, please update the System Property accordingly. For example:

Note that the default enabled or customized EC curves follow the algorithm constraints. For example, the customized EC curves cannot re-activate the disabled EC keys defined by the Java Security Properties.

See JDK-8148516

tools/javadoc(tool)

New --allow-script-in-comments option for javadoc

The javadoc tool will now reject any occurrences of JavaScript code in the javadoc documentation comments and command-line options, unless the command-line option, --allow-script-in-comments is specified.

With the --allow-script-in-comments option, the javadoc tool will preserve JavaScript code in documentation comments and command-line options. An error will be given by the javadoc tool if JavaScript code is found and the command-line option is not set.

JDK-8138725 (not public) Cactus album.

security-libs/javax.xml.crypto

Increase the minimum key length to 1024 for XML Signatures

The secure validation mode of the XML Signature implementation has been enhanced to restrict RSA and DSA keys less than 1024 bits by default as they are no longer secure enough for digital signatures. Additionally, a new security property named jdk.xml.dsig.SecureValidationPolicy has been added to the java.security file and can be used to control the different restrictions enforced when the secure validation mode is enabled.

The secure validation mode is enabled either by setting the xml signature property org.jcp.xml.dsig.secureValidation to true with the javax.xml.crypto.XMLCryptoContext.setProperty method, or by running the code with a SecurityManager.

If an XML Signature is generated or validated with a weak RSA or DSA key, an XMLSignatureException will be thrown with the message, 'RSA keys less than 1024 bits are forbidden when secure validation is enabled' or 'DSA keys less than 1024 bits are forbidden when secure validation is enabled.'

JDK-8140353 (not public)

docs/release_notes

Restrict certificates with DSA keys less than 1024 bits.

DSA keys less than 1024 bits are not strong enough and should be restricted in certification path building and validation. Accordingly, DSA keys less than 1024 bits have been deactivated by default by adding 'DSA keySize < 1024' to the jdk.certpath.disabledAlgorithms security property. Applications can update this restriction in the security property (jdk.certpath.disabledAlgorithms) and permit smaller key sizes if really needed (for example, 'DSA keySize < 768').

JDK-8139565 (not public)

security-libs

More checks added to DER encoding parsing code

More checks are added to the DER encoding parsing code to catch various encoding errors. In addition, signatures which contain constructed indefinite length encoding will now lead to IOException during parsing. Note that signatures generated using JDK default providers are not affected by this change.

JDK-8168714 (not public)

core-libs/java.net

Additional access restrictions for URLClassLoader.newInstance

Class loaders created by the java.net.URLClassLoader.newInstance methods can be used to load classes from a list of given URLs. If the calling code does not have access to one or more of the URLs and the URL artifacts that can be accessed do not contain the required class, then a ClassNotFoundException, or similar, will be thrown. Previously, a SecurityException would have been thrown when access to a URL was denied. If required to revert to the old behavior, this change can be disabled by setting the jdk.net.URLClassPath.disableRestrictedPermissions system property.

JDK-8151934 (not public)

Bug Fixes

The following are some of the notable bug fixes included in this release:

client-libs/javax.swing

Trackpad scrolling of text on OS X 10.12 Sierra is very fast

The MouseWheelEvent.getWheelRotation() method returned rounded native NSEvent deltaX/Y events on Mac OS X. The latest macOS Sierra 10.12 produces very small NSEvent deltaX/Y values so rounding and summing them leads to the huge value returned from the MouseWheelEvent.getWheelRotation(). The JDK-8166591 fix accumulates NSEvent deltaX/Y and the MouseWheelEvent.getWheelRotation() method returns non-zero values only when the accumulated value exceeds a threshold and zero value. This is compliant with the MouseWheelEvent.getWheelRotation() specification (https://docs.oracle.com/javase/8/docs/api/java/awt/event/MouseWheelEvent.html#getWheelRotation):

'Returns the number of 'clicks' the mouse wheel was rotated, as an integer. A partial rotation may occur if the mouse supports a high-resolution wheel. In this case, the method returns zero until a full 'click' has been accumulated.'

For the precise wheel rotation values, use the MouseWheelEvent.getPreciseWheelRotation() method instead.

Jdk

See JDK-8166591

This release also contains fixes for security vulnerabilities described in the Oracle Java SE Critical Patch Update Advisory. For a more complete list of the bug fixes included in this release, see the JDK 8u121 Bug Fixes page.

Known Issues

security-libs/javax.net.ssl

IllegalArgumentException from TLS handshake

A recent issue from the JDK-8148516 fix can cause issue for some TLS servers. The problem originates from an *IllegalArgumentException* thrown by the TLS handshaker code:

The issue can arise when the server doesn't have elliptic curve cryptography support to handle an elliptic curve name extension field (if present). Users are advised to upgrade to this release. By default, JDK 7 Updates and later JDK families ship with the SunEC security provider which provides elliptic curve cryptography support. Those releases should not be impacted unless security providers are modified.

See JDK-8173783

deploy/packager

javapackager and fx:deploy bundle the whole JDK instead of JRE

There is a known bug in the Java Packager for Mac where the entire JDK may be bundled with the application bundle resulting in an unusually large bundle. The work around is to use the bundler option -Bruntime option. For example: -Bruntime=JavaAppletPlugin.plugin sets where the JavaAppletPlugin.plugin for the desired JRE to bundle is located in the current directory.

See JDK-8166835

install/install

Java Installation will fail for non-admin users with UAC off

The Java installation on Windows will fail without warning or prompting, for non-admin users with User Access Control (UAC) disabled. The installer will leave a directory, jds<number>.tmp, in the %TEMP% directory.

JDK-8161460 (not public)

Question or issue on macOS:

We have been using Tomcat (v7) on OS X for quite some time now and never experienced any problems. However, after updating the OS to High Sierra, the web applications do not work anymore when compression is enabled in the server.xml.

Chrome constantly shows an ERR_CONTENT_DECODING_FAILED (obviously without any content displaying). When compression is switched off, everything works fine. I assume the root of the problem is Apple’s upgrade of zlib in High Sierra. Everything was working fine on Sierra. The Tomcat log files look flawless — there is no mention of any error occurring there.

Does anyone experience the same issue and managed to fix it or knows of a viable workaround without disabling compression?

Also, it would also be helpful if someone can confirm that newer versions of Tomcat do not experience this issue on High Sierra.

Thanks for your help.

How to solve this problem?

Solution no. 1:

This is a bug in how the Java SDK setLevel() method is implemented. It is reported that compressed data resulting from setting the level is discarded by the SDK. That will result in corrupted compressed data. The fix for the bug can be found here, written by xuemingshen.

Solution no. 2:

Workaround till an actual fix is found for this: turn off compression in your tomcat project’s server.xml configuration.

Jdk 8 High Sierra Full

Solution no. 3:

Workarround/Hack for Windows: Unfortunately I am not familiar with OS X, but I am facing the same problem on Windows and have been able to find a little bit dirty solution for it. The deflate.c error has been fixed in 8u162-ea, see https://bugs.openjdk.java.net/browse/JDK-8189789

Unfortunately 8u162-ea may not contain all fixes or is probably not good enough for a production environment.

To fix it under 8u152, download and install the latest update from http://jdk.java.net/8/

Go to the installation folder (for instance C:Javajdk8-162-eajrebin) and copy the zip.dll which contains the fix (see JDK 9 deflate.c fix) and paste it on the same place under the jdk 8u152.

I hope you can find something similar under OS X.

Solution no. 4:

Jdk 8 High Sierra Free

Fyi, OS X users, I tried installing JDK 8u162-ea from http://jdk.java.net/8/, and it did not fix the issue. I think the reason is that, unlike the Windows JDK, the OS X JDK does not bundle zlib, but rather uses the zlib that is included with OS X (/usr/lib/libz.1.dylib). This can be seen by looking at the shared libraries the java executable depends on:

Jdk 8 High Sierra Update

So I think we need a fix for this issue from Apple in the form of an
update for High Sierra.

Solution no. 5:

Jdk 8 High Sierra Free

Our workaround for local dev: We use spring boot and have an EmbeddedServletContainerCustomizer. After updated to High Sierra, same issue. The problem only exists for local development, so not something to push to production. As mentioned above we turned off compressing in our MainConfiguration as follows:

Jdk 8 High Sierra Installer

Hope this helps!