Coldfusion version

Security updates available for Adobe ColdFusion | APSB23-40 Adobe has released security updates for ColdFusion versions 2023, 2021 and 2018. These updates resolve critical and important vulnerabilities that could lead to arbitrary code execution and security feature bypass.Adobe is aware that CVE-2023-29298 has been exploited in the wild in limited attacks targeting Adobe ColdFusion. Adobe categorizes these updates with the following priority rating and recommends users update their installations to the newest versions: Adobe recommends updating your ColdFusion JDK/JRE LTS version to the latest update release. Check the ColdFusion support matrix for your supported JDK versionApplying the ColdFusion update without a corresponding JDK update will NOT secure the server. See the relevant Tech Notes for more details.Adobe also recommends customers apply the security configuration settings as outlined on the ColdFusion Security page as well as review the respective Lockdown guides. ColdFusion 2018 Auto-Lockdown Guide ColdFusion 2021 Lockdown GuideColdFusion 2023 Lockdown Guide Adobe would like to thank the following for reporting the relevant issues and for working with Adobe to help protect our customers:Stephen Fewer - CVE-2023-29298Nicolas Zilio (CrowdStrike) - CVE-2023-29300Brian Reilly - CVE-2023-29301NOTE: Adobe has a private, invite-only, bug bounty program with HackerOne. If you are interested in working with Adobe as an external security researcher, please fill out this form for next steps. ColdFusion JDK Requirement COLDFUSION 2023 (version 2023.0.0.330468) and aboveFor Application ServersOn JEE installations, set the following JVM flag, "-Djdk.serialFilter= !org.mozilla.**;!com.sun.syndication.**;!org.apache.commons.beanutils.**; !org.jgroups.**", in the respective startup file depending on the type of Application Server being used.For example:Apache

A previous version of ColdFusion. Feature Deprecated in The value fire_now from the attribute onmisfire of cfschedule. Adobe ColdFusion (2021 release) cfmediaplayer tag Adobe ColdFusion (2018 release) cfscript support for script-based CFCs, such as query and storedproc . Adobe ColdFusion (2018 release) Service layer CFC’s webservices, such as pdfs and images. Adobe ColdFusion (2018 release) GetMetricData parameter cacheops Adobe ColdFusion (2018 release) cftable function Adobe ColdFusion (2018 release) HTMLEditFormat function Use the EncodeForHTML function as alternative. Adobe ColdFusion (2018 release) cfinsert attributes: connectString dbName dbServer dbType provider providerDSN Adobe ColdFusion (2018 release) cfselect attribute passthrough Adobe ColdFusion (2018 release) cfindex attributes: docBoost fieldBoost Solr has removed these attributes. Adobe ColdFusion (2018 release) cfsearch attributes: external language Adobe ColdFusion (2018 release) cfchart– format=flash Adobe ColdFusion (2016 release) The following UI tags based on YUI toolkit: cftree cfcalendar cfmenu cfsprydataset Adobe ColdFusion (2016 release) cfapplet tag Adobe ColdFusion (2016 release) cfcollection attribute path Adobe ColdFusion (2016 release) cfinput attributes passthrough autosuggest sourceForToolTip Impacted after deprecation of YUI and Spry libraries in ColdFusion (2016 release) Update 3. passthrough was deprecated in Adobe ColdFusion (2018 release) ParameterExists function Use the isDefined function as an alternative. ColdFusion MX GetTemplatePath function Use the GetBaseTemplatePath function as an alternative. ColdFusion MX Spanish (Mexican) locale in SetLocale function. ColdFusion MX What This Means for You We understand that these changes may impact your workflows and codebase. We encourage you to explore alternative solutions for the affected features as needed. The ColdFusion team is available to address any questions or concerns you may have and provide guidance during this transition. What’s Next We will keep you informed about future updates and are committed to supporting you throughout this process. Thank you for your understanding and for being a valued ColdFusion user. We appreciate your continued trust in our platform. Contact us If you have any questions, feedback, or suggestions, please get in touch with us at cf-deprecation@adobe.com

IntroductionCentral Config Server (CCS) is a separate server meant to create, manage, and quickly deploy ColdFusion administrator settings. Using CCS, you can:Add/edit/delete a ColdFusion server instance to CCS.Add/edit/delete any setting (in ColdFusion Admin) and propagate the change to all the servers, which have been added to CCS.Create multiple clusters of ColdFusion servers. Within a cluster, you can categorize servers as stage/production, apply changes to stage servers, test performance, and then apply the same changes to the production server. Audit/monitor the changes to a ColdFusion server/instance. View the version history, which tracks all the changes done in ColdFusion Admin, and rolls back to any older version. Install CCSUsing ColdFusion Package ManagerNavigate to /cfusion/bin.Enter cfpm.batType install ccsUsing ColdFusion AdministratorYou can also install CCS using ColdFusion Administrator > Package Manager.Start CCSOnce the CCS package is installed, you can start the CCS server using ccs.bat on Windows and ccs.sh on non-Windows platforms.Launch ccs.sh/ccs.bat.Use the command “startServer” to start CCS Server. Start CCS This starts the server in an interactive mode. To start server in a non -interactive mode run command:ccs.sh/bat startserver Start the server Enter help in the CCS.sh/CCS.bat console to learn about other supported commands. View CCS help Other CCS CommandsCommandUsageDescriptionstartserverccsserver>startserverStarts the Central Config Server.stopserverccsserver>stopserverStops the Central Config Server.listnodesccsserver>listnodesLists the Central Config Server.disablenodeccsserver>disablenode node Disable the node that has been added.enablenodeccsserver>enablenode nodeEnable the node that has been added.deletenodeccsserver>deletenode nodeDelete the node that has been added. Add a node to CCSOnce the CCS server is started , you can add nodes to CCS. Add the nodes manually. CCS's Auto Discovery option is ONLY VALID until ColdFusion (2023 release) Update 6. Adding Nodes using Auto-DiscoveryYou can also use the auto-discovery feature to automatically detect nodes in the same network and add them to your CCS server.Navigate to the Administrator console of the ColdFusion instance from where CCS Server is started.On the CCS page in Server Settings, you have a client section and the server section. Go to the server section and click Start Auto Discovery. This will list the set of nodes that it can find in its network of ColdFusion that are running. You can choose any node to add to your environment. List of nodes Adding nodes manually using ColdFusion Administrator consoleNavigate to the Administrator console of the ColdFusion instance from where CCS Server is started. On the CCS page, you have a client section and a server section. Go to the server

Macromedia HomeSite+ for Dreamweaver MX Release Notes System Requirements Installing and Uninstalling New Features and Enhancements Integration with other Macromedia Products FTP & RDS Registry Settings Change Shell Namespace Extension Compatibility Known Issues Documentation Notes System Requirements Intel Pentium-compatible processor, Pentium II or higher recommended Microsoft Windows 98/ME/NT4/2000 Professional/XP Professional, Home Internet Explorer 4.5 or higher 64 MB of available RAM, 128 MB recommended 40 MB of free hard disk space 800 x 600, 256-color display CD ROM Drive for packaged version ColdFusion 5 or higher Server (for ColdFusion application debugging, database access, and deployment) Installing and Uninstalling To uninstall HomeSite 4.5.2 after installing HomeSite+, you must first uninstall HomeSite+. Here's the proper sequence: Install HomeSite 4.5.2 Install HomeSite+ Uninstall HomeSite+ Uninstall HomeSite 4.5.2 Installation Known Issues JRun Studio 3.0.1 may be installed on the same computer as ColdFusion Studio 5 and/or HomeSite+. The preferred sequence of installation is to install JRun 3.0.1 and then ColdFusion Studio 5 and/or HomeSite+. But, if you do install JRun Studio 3.0.1 after installing ColdFusion Studio 5 and/or HomeSite+, you must reinstall ColdFusion Studio 5 and/or HomeSite+. If you uninstall HomeSite+ when you have more than one version installed on the same computer, do not select to delete the shared files during the uninstallation. For example, when HomeSite 4.5.2 and HomeSite+ are installed on the same computer and you uninstall HomeSite+, dialogs will appear during the uninstallation asking to delete shared files. In those dialogs, you must select No (the default is Yes). If you do inadvertently delete the files, you will need to reinstall. It is important that earlier versions of HomeSite or ColdFusion Studio are installed before later versions. So, you would reinstall HomeSite or ColdFusion Studio 4.5.2 first and then HomeSite+. [29480] Installation Wizard Known Issue After uninstalling, the InstallShield Wizard Complete dialog may appear, indicating that installation has completed instead of uninstallation. [29633] Installation log If you have installation problems, the HomeSite5Plus.log file, which is installed in the Windows root directory, can be a valuable source of information for troubleshooting the installation routine. You can attach to email sent to

Are you still manually copying CF Admin settings from one instance to another? There may be a much better way available to you, especially with a change introduced in CF 11.Did you know that the ColdFusion Archives (or CAR) mechanism is now available in ColdFusion Standard as well as Enterprise. Prior to CF 11, it was only in Enterprise (or the trial or Developer editions).The CAR mechanism is a very useful feature in the ColdFusion Administrator which lets you easily save any or all CF admin settings from one CF instance into a single file (having a file extension of .car), then you can copy that CAR file to another server to import it into another instance. The new instance can even be a different version of ColdFusion (such as CF 2016). The imported settings are merged with any current admin settings.For more information on using the CAR mechanism, see the ColdFusion documentation on the subject. For still more information on this change in CF11 and about the CAR mechanism in general, see my blog post on the topic from the CF11 timeframe.

Could be because, /dev/random is used on Unix platforms for random number generation.java.security.SecureRandom is designed to be crypto secure. It provides strong and secure random numbers. SecureRandom should be used when high-quality randomness is important and is worth consuming CPU. We can add the below jvm argument, to get rid of performance issue due to random number generation: -Djava.security.egd=file:/dev/./urandom Security scanner If you see CPU spikes at some specific time of the day/week, this could be due to a third party security scanner interfering with your ColdFusion application. The scanner hits the server monitoring port 5500 (by default) with 0.0.0.0, which goes to infinite loop and causes server crash. To fix this issue, we need to modify the jetty.xml at ColdFusionXXXX\cfusion\lib. Change the Server monitoring IP address from 0.0.0.0 to 127.0.0.1 and restart ColdFusion. Code Cache: If your program has high codecache memory set via -XX:ReservedCodeCacheSize, you can limit it by disabling code cache flushing. If flushing is disabled, the JIT does not compile methods after the codecache fills up and hence there won’t be CPU hikes. You can add the following jvm argument. This can be used to flush code cache. XX:-UseCodeCacheFlushing You can also disable tieredcompilation with below argument: -XX:-TieredCompilation (Applicable only with Java 1.8. Java versions less than 8 doesn’t have tiered compilation enabled by default.) Service unavailable error 503 - Service unavailable is a generic error. Whenever we get this error, the first thing we should check is, whether ColdFusion is started and running or not. In case you experience intermittent 503’s, then its time to investigate the less responsive server, which might be dropping requests. This could be because of Long GC pauses or any reason that could delay response from ColdFusion server. The ColdFusion connector tuning can help us to overcome service unavailable error. Below blog post can be used to tune ColdFusion connector and avoid such errors. We have also seen some issues because of bugs in few specific update level of java. The best practice would be to keep your ColdFusion Java updated to latest version. Use the blog below to keep Java up to date. ColdFusion thread dumps ColdFusion thread dumps can be used to analyze New, Runnable, Blocked, Waiting, Timed_Waiting andRunning threads.The issues such as Thread race, Deadlock, Hang IO calls, GC/OutOfMemory exceptions, Infinite Loop can be determined using the thread dumps. Following Blog can be used to take thread dump on a ColdFusion server: If you are on ColdFusion 11 update 12 and ColdFusion (2016 release), you can skip copying threaddump.jar. Use takethreaddump . cfm file to capture the thread dump. Another issue we have seen in one or two cases, If the performance is impacted by XML parsing, the jvm argument below can fix it: -Dcom.sun.xml.bind.v2.bytecode.ClassTailor.noOptimize=true Other causes of performance issues may include: Lack of proper database SQL tuning & capacity planning Application specific performance problems Lack of proper data caching Excessive data caching Excessive logging In case the above steps do not resolve the issue, feel free