We got a security report that we need to update the JRE version - do you provide that?

[natechadwick]

Currently we are running an older Java 1.8 JRE (1.8.0_172) our security team has asked us to update it to a later version for security updates. Do you include the JRE or do we have to manually update it? What versions are supported?

[natechadwick]

Supported JRE's by version

• 7.3.2 Rhythmyx / CM System - Oracle 1.8 JRE
• 5.3 CM1 - Oracle 1.8 JRE
• 5.4 CM1 - Oracle 1.8 JRE
• 8.0.x - Oracle 1.8 JRE, OpenJDK 1.8 JRE (Amazon Corretto, Liberica, etc)

Older versions of Percussion products embedded the JRE, but when Oracle changed their licensing practices it was removed from the products.

Updating the JRE

In all current versions to update the JRE you have a couple of options:

• Use symbolic links to link the {InstallDir}/JRE folder to your system JRE
• Copy the system jre folder to {InstallDir}/JRE

Symbolic Link Approach

The symbolic link approach is convenient because it lets you turn on system updates for the server installed JRE. For example: On a Fedora / Red Hat / Centos style linux server:

cd {InstallDir}
mv JRE JRE_OLD
ln -s /usr/lib/jvm/jre-1.8.0 JRE
ls -al JRE
JRE -> /usr/lib/jvm/jre-1.8.0

With that in place when the system has security updates applied, via yum-cron, or some other means, and the JRE is updated you will always be up to date. This is recommended.

If you linked to /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.332.b09-1.amzn2.0.2.x86_64 instead of the jre-1.8.0 when you security update, the old version will be removed. Requiring you to manually re-add the link to the new version.

NOTE: I am linking in the JDK in the above examples, you could also symlink to /usr/lib/jvm/jre-1.8.0/jre folder instead.

On Windows Servers, symlinks are now supported. The process would be the same, just using Windows commands and syntax. The default install locations for java on windows is in C:\Program Files\Java{JRE - JDK - version}

The JRE copy approach

With this approach you basically copy the update JRE in:

cd {InstallDir}
mv JRE JRE_OLD
cp -R  /usr/lib/jvm/jre-1.8.0 JRE
ls -al JRE
JRE

While this works, you are on the hook for doing that copy the next time a JRE update is shipped. That is why we recommend using symlinks if possible, better to let system updates run.

Related Issues

LDAP authentication / Database publishing stops working after the JRE is updated
The system has a configuration folder located at:

{InstallDir}/rxconfig/trusted_certificates

Any self signed or other certificates (LDAP servers, database servers etc) placed in that folder will be automatically trusted at server startup. When you replace the JRE ,those trusted certificates are currently removed from the JRE trust store, so a restart will be required on JRE update if you use these.

Permissions
The user running the percussion service needs permission to write to the JRE cacerts file to add the trusted certificates.