<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
And so does aarch32
<div class=""><br class="">
<div><br class="">
<blockquote type="cite" class="">
<div class="">Begin forwarded message:</div>
<br class="Apple-interchange-newline">
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class="">
<span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">From:
</b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class="">Andrew Hughes <<a href="mailto:gnu.andrew@redhat.com" class="">gnu.andrew@redhat.com</a>><br class="">
</span></div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class="">
<span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">Subject:
</b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class=""><b class="">OpenJDK 8u362 Released</b><br class="">
</span></div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class="">
<span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">Date:
</b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class="">19 January 2023, 03:59:08 EET<br class="">
</span></div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class="">
<span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">To:
</b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class=""><a href="mailto:jdk8u-dev@openjdk.org" class="">jdk8u-dev@openjdk.org</a><br class="">
</span></div>
<br class="">
<div class="">
<div class="">
<div class="content-isolator__container">We are pleased to announce the release of OpenJDK 8u362.<br class="">
<br class="">
The source tarball is available from:<br class="">
<br class="">
* <a href="https://openjdk-sources.osci.io/openjdk8/openjdk8u362-b09.tar.xz" class="">
https://openjdk-sources.osci.io/openjdk8/openjdk8u362-b09.tar.xz</a><br class="">
<br class="">
The tarball is accompanied by a digital signature available at:<br class="">
<br class="">
* <a href="https://openjdk-sources.osci.io/openjdk8/openjdk8u362-b09.tar.xz.sig" class="">
https://openjdk-sources.osci.io/openjdk8/openjdk8u362-b09.tar.xz.sig</a><br class="">
<br class="">
This is signed by our Red Hat OpenJDK key (<a href="mailto:openjdk@redhat.com" class="">openjdk@redhat.com</a>):<br class="">
<br class="">
PGP Key: rsa4096/0x92EF8D39DC13168F (<a href="hkp://keys.gnupg.net" class="">hkp://keys.gnupg.net</a>)<br class="">
Fingerprint = CA5F 11C6 CE22 644D 42C6 AC44 92EF 8D39 DC13 168F<br class="">
<br class="">
SHA256 checksums:<br class="">
<br class="">
5d832213502d17ee0a4dd70779cabc811a8643ab2fc780d5cd24b6612f07ab93 openjdk8u362-b09.tar.xz<br class="">
7cba773ebf1fe68946cc6a9cf837f36ab795e4529f4915a68abea4d1955ca81f openjdk8u362-b09.tar.xz.sig<br class="">
<br class="">
The checksums can be downloaded from:<br class="">
<br class="">
* <a href="https://openjdk-sources.osci.io/openjdk8/openjdk8u362-b09.sha256" class="">
https://openjdk-sources.osci.io/openjdk8/openjdk8u362-b09.sha256</a><br class="">
<br class="">
New in release OpenJDK 8u362 (2023-01-17):<br class="">
===========================================<br class="">
Live versions of these release notes can be found at:<br class="">
* <a href="https://bit.ly/openjdk8u362" class="">https://bit.ly/openjdk8u362</a><br class="">
* <a href="https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u362.html" class="">
https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u362.html</a><br class="">
<br class="">
* CVEs<br class="">
- CVE-2023-21830<br class="">
- CVE-2023-21843<br class="">
* Security fixes<br class="">
- JDK-8285021: Improve CORBA communication<br class="">
- JDK-8286496: Improve Thread labels<br class="">
- JDK-8288516: Enhance font creation<br class="">
- JDK-8289350: Better media supports<br class="">
- JDK-8293554: Enhanced DH Key Exchanges<br class="">
- JDK-8293598: Enhance InetAddress address handling<br class="">
- JDK-8293717: Objective view of ObjectView<br class="">
- JDK-8293734: Improve BMP image handling<br class="">
- JDK-8293742: Better Banking of Sounds<br class="">
- JDK-8295687: Better BMP bounds<br class="">
* Other changes<br class="">
- JDK-6885993: Named Thread: introduce print() and print_on(outputStream* st) methods<br class="">
- JDK-7124218: [TEST_BUG] [macosx] Space should select cell in the JTable<br class="">
- JDK-8054066: com/sun/jdi/DoubleAgentTest.java fails with timeout<br class="">
- JDK-8067941: [TESTBUG] Fix tests for OS with 64K page size.<br class="">
- JDK-8071530: Update OS detection code to reflect Windows 10 version change<br class="">
- JDK-8073464: GC workers do not have thread names<br class="">
- JDK-8079255: [TEST_BUG] [macosx] Test closed/java/awt/Robot/RobotWheelTest/RobotWheelTest fails for Mac only<br class="">
- JDK-8129827: [TEST_BUG] Test java/awt/Robot/RobotWheelTest/RobotWheelTest.java fails<br class="">
- JDK-8148005: One byte may be corrupted by get_datetime_string()<br class="">
- JDK-8159599: [TEST_BUG] java/awt/Modal/ModalInternalFrameTest/ModalInternalFrameTest.java<br class="">
- JDK-8159720: Failure of C2 compilation with tiered prevents some C1 compilations<br class="">
- JDK-8195607: sun/security/pkcs11/Secmod/TestNssDbSqlite.java failed with "NSS initialization failed" on NSS 3.34.1<br class="">
- JDK-8197859: VS2017 Complains about UINTPTR_MAX definition in globalDefinitions_VisCPP.hpp<br class="">
- JDK-8206456: [TESTBUG] docker jtreg tests fail on systems without cpuset.effective_cpus / cpuset.effective_mems<br class="">
- JDK-8221529: [TESTBUG] Docker tests use old/deprecated image on AArch64<br class="">
- JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails with exitValue = 137<br class="">
- JDK-8233551: [TESTBUG] SelectEditTableCell.java fails on MacOS<br class="">
- JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is failing on 32bit Windows<br class="">
- JDK-8253702: BigSur version number reported as 10.16, should be 11.nn<br class="">
- JDK-8255559: Leak File Descriptors Because of ResolverLocalFilesystem#engineResolveURI()<br class="">
- JDK-8265527: tools/javac/diags/CheckExamples.java fails after JDK-8078024 8u backport<br class="">
- JDK-8269039: Disable SHA-1 Signed JARs<br class="">
- JDK-8269850: Most JDK releases report macOS version 12 as 10.16 instead of 12.0<br class="">
- JDK-8270344: Session resumption errors<br class="">
- JDK-8271459: C2: Missing NegativeArraySizeException when creating StringBuilder with negative capacity<br class="">
- JDK-8273176: handle latest VS2019 in abstract_vm_version<br class="">
- JDK-8274563: jfr/event/oldobject/TestClassLoaderLeak.java fails when GC cycles are not happening<br class="">
- JDK-8274840: Update OS detection code to recognize Windows 11<br class="">
- JDK-8275887: jarsigner prints invalid digest/signature algorithm warnings if keysize is weak/disabled<br class="">
- JDK-8280890: Cannot use '-Djava.system.class.loader' with class loader in signed JAR<br class="">
- JDK-8283277: ISO 4217 Amendment 171 Update<br class="">
- JDK-8283903: GetContainerCpuLoad does not return the correct result in share mode<br class="">
- JDK-8284389: Improve stability of GHA Pre-submit testing by caching cygwin installer<br class="">
- JDK-8284622: Update versions of some Github Actions used in JDK workflow<br class="">
- JDK-8286582: Build fails on macos aarch64 when using --with-zlib=bundled<br class="">
- JDK-8288928: Incorrect GPL header in pnglibconf.h (backport of JDK-8185041)<br class="">
- JDK-8289549: ISO 4217 Amendment 172 Update<br class="">
- JDK-8292762: Remove .jcheck directories from jdk8u subcomponents<br class="">
- JDK-8293181: Bump update version of OpenJDK: 8u362<br class="">
- JDK-8293461: Add a test for JDK-8290832<br class="">
- JDK-8293828: JFR: jfr/event/oldobject/TestClassLoaderLeak.java still fails when GC cycles are not happening<br class="">
- JDK-8294307: ISO 4217 Amendment 173 Update<br class="">
- JDK-8294357: (tz) Update Timezone Data to 2022d<br class="">
- JDK-8294863: Enable partial tier1 testing in GHA for JDK8<br class="">
- JDK-8295164: JDK 8 jdi tests should not use tasklist command on Windows<br class="">
- JDK-8295173: (tz) Update Timezone Data to 2022e<br class="">
- JDK-8295288: Some vm_flags tests associate with a wrong BugID<br class="">
- JDK-8295714: GHA ::set-output is deprecated and will be removed<br class="">
- JDK-8295723: security/infra/wycheproof/RunWycheproof.java fails with Assertion Error<br class="">
- JDK-8295915: Problemlist compiler/rtm failures specific to 8u<br class="">
- JDK-8295950: Enable langtools/tier1 in GHA for 8u<br class="">
- JDK-8296108: (tz) Update Timezone Data to 2022f<br class="">
- JDK-8296239: ISO 4217 Amendment 174 Update<br class="">
- JDK-8296555: Enable hotspot/tier1 for 64-bit builds in GHA for 8u<br class="">
- JDK-8296715: CLDR v42 update for tzdata 2022f<br class="">
- JDK-8296959: Fix hotspot shell tests of 8u on multilib systems<br class="">
- JDK-8297141: Fix hotspot/test/runtime/SharedArchiveFile/DefaultUseWithClient.java for 8u<br class="">
- JDK-8297804: (tz) Update Timezone Data to 2022g<br class="">
- JDK-8299439: java/text/Format/NumberFormat/CurrencyFormat.java fails for hr_HR<br class="">
- JDK-8299483: ProblemList java/text/Format/NumberFormat/CurrencyFormat.java<br class="">
- JDK-8300178: JDK-8286496 causes build failure on older GCC<br class="">
- JDK-8300225: JDK-8288516 causes build failure on Windows + VS2010<br class="">
<br class="">
Notes on individual issues:<br class="">
===========================<br class="">
<br class="">
client-libs/javax.imageio:<br class="">
<br class="">
JDK-8295687: Better BMP bounds<br class="">
==============================<br class="">
Loading a linked ICC profile within a BMP image is now disabled by<br class="">
default. To re-enable it, set the new system property<br class="">
`sun.imageio.bmp.enabledLinkedProfiles` to `true`. This new property<br class="">
replaces the old property,<br class="">
`sun.imageio.plugins.bmp.disableLinkedProfiles`.<br class="">
<br class="">
client-libs/javax.sound:<br class="">
<br class="">
JDK-8293742: Better Banking of Sounds<br class="">
=====================================<br class="">
Previously, the SoundbankReader implementation,<br class="">
`com.sun.media.sound.JARSoundbankReader`, would download a JAR<br class="">
soundbank from a URL. This behaviour is now disabled by default. To<br class="">
re-enable it, set the new system property `jdk.sound.jarsoundbank` to<br class="">
`true`.<br class="">
<br class="">
hotspot/runtime:<br class="">
<br class="">
JDK-8274840: Release Now Recognises Windows 11<br class="">
==============================================<br class="">
This release now correctly sets the `os.name` property to `Windows<br class="">
11`, as would be expected.<br class="">
<br class="">
other-libs/corba:idl:<br class="">
<br class="">
JDK-8285021: Improve CORBA communication<br class="">
========================================<br class="">
The JDK's CORBA implementation now refuses by default to deserialize<br class="">
objects, unless they have the "IOR:" prefix. The previous behaviour<br class="">
can be re-enabled by setting the new property<br class="">
`com.sun.CORBA.ORBAllowDeserializeObject` to `true`.<br class="">
<br class="">
security-libs/java.security:<br class="">
<br class="">
JDK-8269039: Disabled SHA-1 Signed JARs<br class="">
=======================================<br class="">
JARs signed with SHA-1 algorithms are now restricted by default and<br class="">
treated as if they were unsigned. This applies to the algorithms used<br class="">
to digest, sign, and optionally timestamp the JAR. It also applies to<br class="">
the signature and digest algorithms of the certificates in the<br class="">
certificate chain of the code signer and the Timestamp Authority, and<br class="">
any CRLs or OCSP responses that are used to verify if those<br class="">
certificates have been revoked. These restrictions also apply to<br class="">
signed JCE providers.<br class="">
<br class="">
To reduce the compatibility risk for JARs that have been previously<br class="">
timestamped, there is one exception to this policy:<br class="">
<br class="">
- Any JAR signed with SHA-1 algorithms and timestamped prior to<br class="">
January 01, 2019 will not be restricted.<br class="">
<br class="">
This exception may be removed in a future JDK release. To determine if<br class="">
your signed JARs are affected by this change, run:<br class="">
<br class="">
$ jarsigner -verify -verbose -certs`<br class="">
<br class="">
on the signed JAR, and look for instances of "SHA1" or "SHA-1" and<br class="">
"disabled" and a warning that the JAR will be treated as unsigned in<br class="">
the output.<br class="">
<br class="">
For example:<br class="">
<br class="">
Signed by "CN="Signer""<br class="">
Digest algorithm: SHA-1 (disabled)<br class="">
Signature algorithm: SHA1withRSA (disabled), 2048-bit key<br class="">
<br class="">
WARNING: The jar will be treated as unsigned, because it is signed with a weak algorithm that is now disabled by the security property:<br class="">
<br class="">
jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, DSA keySize < 1024, SHA1 denyAfter 2019-01-01<br class="">
<br class="">
JARs affected by these new restrictions should be replaced or<br class="">
re-signed with stronger algorithms.<br class="">
<br class="">
Users can, *at their own risk*, remove these restrictions by modifying<br class="">
the `java.security` configuration file (or override it by using the<br class="">
`java.security.properties` system property) and removing "SHA1 usage<br class="">
SignedJAR & denyAfter 2019-01-01" from the<br class="">
`jdk.certpath.disabledAlgorithms` security property and "SHA1<br class="">
denyAfter 2019-01-01" from the `jdk.jar.disabledAlgorithms` security<br class="">
property.<br class="">
<br class="">
Thanks,<br class="">
-- <br class="">
Andrew :)<br class="">
Pronouns: he / him or they / them<br class="">
Senior Free Java Software Engineer<br class="">
OpenJDK Package Owner<br class="">
Red Hat, Inc. (<a href="http://www.redhat.com" class="">http://www.redhat.com</a>)<br class="">
<br class="">
PGP Key: ed25519/0xCFDA0F9B35964222 (<a href="hkp://keys.gnupg.net" class="">hkp://keys.gnupg.net</a>)<br class="">
Fingerprint = 5132 579D D154 0ED2 3E04 C5A0 CFDA 0F9B 3596 4222<br class="">
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>