RELEASE NOTES: JDK 21.0.9

Update XML Security for Java to 3.0.5

The XML Signature implementation has been updated to Santuario 3.0.5. Support for four new SHA-3 based ECDSA signature methods have been added: ECDSA_SHA3_224, ECDSA_SHA3_256, ECDSA_SHA3_384, and ECDSA_SHA3_512. While these new algorithm URIs are not defined in javax.xml.crypto.dsig.SignatureMethod in the JDK update releases, they may be represented as string literals in order to be functionally equivalent. SHA-3 hash algorithm support was delivered to JDK 9 via JEP 287. Releases earlier than that may use third party security providers.

Update XML Security for Java to 3.0.5

The XML Signature implementation has been updated to Santuario 3.0.5. Support for four new SHA-3 based ECDSA SignatureMethod algorithms have been added: SignatureMethod.ECDSA_SHA3_224, SignatureMethod.ECDSA_SHA3_256, SignatureMethod.ECDSA_SHA3_384, and SignatureMethod.ECDSA_SHA3_512.

`GZIPInputStream` Will No Longer Use `InputStream.available()` to Check for the Presence of Concatenated GZIP Stream

The GZipInputStream read methods have been modified to remove the usage of InputStream::available() when determining if the stream contains a concatenated GZIP stream. These methods will now read any additional data in the underlying InputStream and check for the presence of a GZIP stream header.

Mechanism to Disable Signature Schemes Based on Their TLS Scope

TLS protocol specific usage constraints are now supported by the jdk.tls.disabledAlgorithms property in the java.security configuration file, as follows: ``` UsageConstraint: usage UsageType { UsageType }

UsageType: HandshakeSignature | CertificateSignature `` HandshakeSignaturerestricts the use of an algorithm in TLS handshake signatures.CertificateSignaturerestricts the use of an algorithm in certificate signatures. An algorithm with this constraint cannot include other usage types defined in thejdk.certpath.disabledAlgorithms` property. The usage type follows the keyword and more than one usage type can be specified with a whitespace delimiter.

Mechanism to Disable TLS Cipher Suites by Pattern Matching

TLS cipher suites can be disabled with the jdk.tls.disabledAlgorithms security property in the java.security configuration file using one or more * wildcard characters. For example, "TLSRSA*" disables all cipher suites that start with "TLSRSA". Only cipher suites starting with "TLS_" are allowed to have wildcard characters.

Improved Logging Behavior for javax.net.debug=ssl JSSE Debug Property

The logging behavior of the TLS javax.net.debug system property has been improved in this release. The javax.net.debug property is used to generate TLS debug logs from the default JSSE provider. Previously, using the ssl option via -Djavax.net.debug=ssl produced very limited output, which reduced its usefulness for troubleshooting.

With this update, setting -Djavax.net.debug=ssl now enables comprehensive SSL debug logging, except for the data, packet, and plaintext sub-options. Applications using this option will now see significantly more detailed debug information in logs.

Disable "best-fit" Mapping on Windows Command Line

Command line arguments to the Java launcher are no longer converted with Windows' "best-fit" mapping when the arguments include unmappable characters for the ANSI code page. This mapping has been intervening in the Java launcher's argument parsing. Unmappable characters are now replaced with the default replacement character, such as '?' in some cases. For rare cases, where applications need those unmappable characters on the command line, select UTF-8 in Windows Regional Settings.

Print 'rss' and 'cache' As Part of the Container Information

The HotSpot runtime code has been updated to additionally print a container's 'rss' and 'cache'. The additional output can be found in the JVM's response to a "jcmd [PID] VM.info" request and in the hs_err file generated in case of JVM abrupt termination.

This will help monitoring and troubleshooting OutOfMemory situations as OOM killer can terminate a process if its rss + cache usage reaches the max memory limit of the container.

Removed Four AffirmTrust Root Certificates

The following root certificates, which are deactivated and no longer in use, have been removed from the cacerts keystore:

``` + alias name "affirmtrustcommercialca [jdk]" Distinguished Name: CN=AffirmTrust Commercial, O=AffirmTrust, C=US

• alias name "affirmtrustnetworkingca [jdk]" Distinguished Name: CN=AffirmTrust Networking, O=AffirmTrust, C=US

• alias name "affirmtrustpremiumca [jdk]" Distinguished Name: CN=AffirmTrust Premium, O=AffirmTrust, C=US

• alias name "affirmtrustpremiumeccca [jdk]" Distinguished Name: CN=AffirmTrust Premium ECC, O=AffirmTrust, C=US ```

SunMSCAPI Provider Opens the Windows Local Computer Key Store in Read-Only Mode in Non-Elevated Processes

The Local Computer key store is accessed using the CERT_STORE_MAXIMUM_ALLOWED_FLAG. Since this store is typically managed by administrators for security reasons, processes are only given read-only access to specific private keys. By opening the store in read-only mode, non-elevated processes can now securely use these keys without requiring elevated permissions.