Azul Zulu Community Release Notes Zulu 15, 13, 11, 8, and 7 January 2021 Quarterly Update Release Release Date: January 19, 2021 Document Version: 1.1 Last Modified: January 29, 2021 Zulu Release Notes Revision History Revision Date Description 1.0 January 19, 2021 Initial version of the document 1.1 January 29, 2021 The Legal Notice section added. Azul Systems 2 Zulu Release Notes Revision History 2 Azul Zulu Overview 5 January 2021 Release Details 5 Summary 5 IANA time zone data version 6 New Features 7 Common Vulnerabilities and Exposures Fixes 8 Non-CVE Security Fixes, OpenJDK, OpenJFX, and Zulu Bug Fixes 10 Non-CVE Security Fixes 10 OpenJDK Bug Fixes 10 OpenJFX Bug Fixes 10 Zulu Bug Fixes 15 Supported Platforms 16 Target Operating Environments 18 Running Zulu 20 Deployment Targets 20 Performance and Standards 20 Zulu Commercial Compatibility Kit 21 Troubleshooting Tips 22 Preparation Tips 22 VM Property Override 22 Azul Systems 3 Zulu Release Notes JRE-only Tips 22 Tomcat Advisory 23 Cassandra Issue 23 Azul Repository Tips 23 New mapping rules from a Java native method name to a C native library implementation function name 24 Creating a Symlink to the jvm-exports Directory 25 Running Java Flight Recording in Zulu 8 26 CKR_SAVED_STATE_INVALID exception on Solaris 10 26 Problem with running Java on Windows 10 when JAVA_HOME contains Non-ASCII characters 27 Open Product Issues 27 Support Information 28 Legal Notice 29 Azul Systems 4 Zulu Release Notes Azul Zulu Overview Azul® Zulu® is a Java Development Kit (JDK), and a compliant implementation of the Java Standard Edition (SE) specification that contains all the Java components needed to build and run Java SE applications. Zulu has been verified by passing all tests of the OpenJDK Community Technology Compatibility Kit (TCK) as available for each respective Java SE version. Java SE Certified is a certification mark of the Java Community Project. January 2021 Release Details Summary Quarterly JDK 15, 13, 11, 8, and 7 update Released: January 19, 2021 Azul Zulu distribution types: SA are tested, certified, and commercially supported Azul Zulu builds of OpenJDK whereby Azul ensures that software that uses the Accessible APIs of the product is not required to carry a specific license and that such use does not contaminate the code or intellectual property of such software with any license requirements. NV are tested, certified, and commercially supported Azul Zulu builds of OpenJDK. CA are Azul Zulu builds of OpenJDK that are free to download and use. The following table lists details of the Zulu versions released with the current update: Based on** Includes Support Java SE Java Update Zulu JDK Zulu JDK for JavaFX Version Type* Version Version Version Version Version*** 15 PSU 15.29 15.0.2+7 15.28 15.0.1+9 15.0.2+101 Azul Systems 5 Zulu Release Notes Based on** Includes Support Java SE Java Update Zulu JDK Zulu JDK for JavaFX Version Type* Version Version Version Version Version*** CPU 13.36 13.0.5.1.101+5 13.35 13.0.5.1+1 15.0.1.0.101+100 13 PSU 13.37 13.0.6+5 13.36 13.0.5.1.101+5 15.0.2+101 CPU 11.44 11.0.9.1.101+5 11.43 11.0.9.1+1 15.0.1.0.101+100 11 PSU 11.45 11.0.10+9 11.44 11.0.9.1.101+5 15.0.2+101 CPU 8.51 8u281-b07 8.50 8u275-b01 8u281-b01 8 PSU 8.52 8u282-b08 8.51 8u281-b07 8u282-b01 CPU 7.43 7u291-b07 7.42 7u285-b01 N/A 7 PSU 7.44 7u292-b07 7.43 7u291-b07 N/A *Java Update Type: l CPU (Critical Patch Updates) contain fixes to security vulnerabilities and critical bug fixes. Zulu CPU releases are generally based on prior-cycle PSU releases, with only security fixes applied. They provide a low-risk vehicle for the potentially urgent deployment of security fixes when issues of sufficient severity arise. CPU releases are available in SA and NV distributions. l PSU (Patch Set Updates) incorporates all of fixes in the corresponding CPU, as well as additional non-security bug fixes. Zulu PSU releases incorporate both security fixes and other accumulated changes that align the release contents with the associated OpenJDK project quarterly release. PSU releases are available in SA, NV, and CA distributions. **Based on: Zulu CPU releases are based on prior-cycle PSU releases. Zulu PSU releases are based on the current-cycle CPU releases. ***Includes Support for JavaFX Version: Information is relevant for the builds that include JavaFX support. IANA time zone data version This release of Zulu comes with IANA time zone data version 2020d. Version 2020d includes the following changes: Azul Systems 6 Zulu Release Notes l Palestine ends DST earlier than predicted, on 2020-10-24. For more information, see https://data.iana.org/time-zones/tzdb-2020d/NEWS. New Features Support for Apple Silicon This Azul Zulu™ release includes macOS builds for the new Mac devices based on Apple Silicon, which Apple announced on November 10, 2020. With the latest versions of Zulu macOS builds, you can use, develop, and debug your Java applications on new Apple Silicon Macs. Known Limitations: The following features are not guaranteed to work on the new platform. For Zulu 15, 13, and 11: l Application Class Data Sharing l Ahead-of-Time Compilation (Experimental) l Graal JIT Compiler (Experimental) For Zulu 8: l Hotspot Serviceability Agent New Experimental Features Zulu includes optional experimental support for interaction with connected runtime services through an emerging protocol. These experimental capabilities are enabled by the -XX:+UseCRS flag and are turned off by default. The - XX:+UnlockExperimentalVMOptions must also be on for this option to work. Azul Systems 7 Zulu Release Notes Common Vulnerabilities and Exposures Fixes This section summarizes Common Vulnerabilities and Exposure (CVE ) fixes of the January 2021 OpenJDK release. January 2021 CVE Fixes CVSS VERSION 3.0 RISK Remote Supported Exploit Base Attack Attack Privs User Confid- Inte- Avail- Zulu CVE # Component Protocol Scope Notes without Score Vector Complex Req'd Interact entiality grity ability Versions Auth. Affected CVE-2020-14803 Libraries Multiple Yes 5.3 Network L N N U L N N N/A* Note 1 * Fixed in October 2020 CPU and PSU releases of Zulu. Base and Impact Metrics: Metric Values Attack Vector Network (N), Adjacent (A), Local (L), and Physical (P) Attack Complexity Low (L) and High (H) Privileges Required None (N), Low (L), and High (H) User Interaction None (N) and Required (R) Scope Unchanged (U) and Changed (C) Confidentiality Impact High (H), Low (L), and None (N) Integrity Impact High (H), Low (L), and None (N) Availability Impact High (H), Low (L), and None (N) Azul Systems 8 Zulu Release Notes Notes: ID Notes This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox 1 for security. Azul Systems 9 Zulu Release Notes Non-CVE Security Fixes, OpenJDK, OpenJFX, and Zulu Bug Fixes This section summarizes January 2021 changes. l Non-CVE Security Fixes l OpenJDK Bug Fixes l OpenJFX Bug Fixes l Zulu Bug Fixes Non-CVE Security Fixes The following table summarizes non-CVE security fixes implemented in January 2021 Zulu release. OpenJDK Zulu Version Synopsis CPU/PSU Patch ID Improve Direct Buffering of JDK-8247619 15, 13, 11, 8, 7 CPU Characters OpenJDK Bug Fixes The following table describes the OpenJDK changes implemented in January 2021 Zulu release. (missing or bad snippet) OpenJFX Bug Fixes The following table describes the OpenJFX changes implemented in January 2021 Zulu release. OpenJDK Zulu Version Synopsis CPU/PSU Patch ID JDK-8258592 15 Control labels in Dialogs are truncated at cer- PSU Azul Systems 10 Zulu Release Notes OpenJDK Zulu Version Synopsis CPU/PSU Patch ID tain DPI scaling levels JDK-8257897 15 Fix webkit build for XCode 12 PSU Allow building of JavaFX native libs for Apple JDK-8257758 15 PSU Silicon JFXPanel scene fails to render correctly on JDK-8257719 15 PSU HiDPI after fix for JDK-8199592 GitHub actions: specify the version of each JDK-8256983 15 PSU platform OS and compiler GitHub actions: build fails on Linux due to JDK-8256978 15 PSU missing package TreeViewSkin/Behavior: misbehavior on JDK-8256821 15 PSU switching skin GitHub actions: build fails due to upgraded JDK-8256686 15 PSU MSVC compiler Parameterized tests must not use instances JDK-8256649 15 PSU as parameters JDK-8256184 15 Openjfx build broken (Eclipse) PSU JDK-8256012 15 Fix build of Monocle for Linux PSU Gtk glass backend should run with Gtk+ 3.8 JDK-8255723 15 PSU (minimum) Switch FX build to use JDK 15.0.1 as boot JDK-8255714 15 PSU JDK [TestBug] Controls unit tests - clean up unne- JDK-8255497 15 PSU cessary prints on STANDARD_OUT JDK-8255487 15 Mark SandboxAppTest unstable on Windows PSU Azul Systems 11 Zulu Release Notes OpenJDK Zulu Version Synopsis CPU/PSU Patch ID Nested calls to snap methods in Region give JDK-8255415 15 PSU different results [TestBug] Controls unit tests - ButtonTest and JDK-8255337 15 PSU ComboBoxTest - log ClassCastException [TestBug] Re-enable few ignored tests in JDK-8255241 15 javafx.controls module that pass with latest PSU code Many javafx.controls unit tests have incorrect JDK-8255002 15 PSU name containing impl_* JDK-8254964 15 Fix default values in Spinner class PSU JDK-8254691 15 Enable GitHub actions for jfx repo PSU JDK-8254605 15 repaint on Android broken PSU Remove hard dependency on Dispman in JDK-8254569 15 PSU Monocle fb rendering JDK-8254255 15 Remove obsolete .hgignore file PSU Update copyright header for files modified in JDK-8254101 15 PSU 2020 FX: Update copyright year in docs, readme JDK-8254100