RELEASE NOTES FOR: openjdk8u392 ==================================================================================================== Notes generated: Wed Oct 02 01:20:27 CEST 2024 Hint: Prefix bug IDs with https://bugs.openjdk.org/browse/ to reach the relevant JIRA entry. JAVA ENHANCEMENT PROPOSALS (JEP): None. RELEASE NOTES: security-libs/org.ietf.jgss: JDK-6722928: Added a Default Native GSS-API Library on Windows A native GSS-API library named `sspi_bridge.dll` has been added to the JDK on the Windows platform. The library is client-side only and uses the default credentials. It will be loaded when the `sun.security.jgss.native` system property is set to "true". A user can still load a third-party native GSS-API library by setting the `sun.security.jgss.lib` system property to the appropriate path. Native GSS automatically uses cached credentials from operating systems, thus the `javax.security.auth.useSubjectCredsOnly` system property should be set to false. `com.sun.security.auth.module.Krb5LoginModule` does not call native JGSS. Avoid using `com.sun.security.auth.module.Krb5LoginModule` from JAAS config. security-libs/org.ietf.jgss:krb5: JDK-8139348: Deprecate 3DES and RC4 in Kerberos The `des3-hmac-sha1` and `rc4-hmac` Kerberos encryption types (etypes) are now deprecated and disabled by default. Users can set `allow_weak_crypto = true` in the `krb5.conf` configuration file to re-enable them (along with other weak etypes including `des-cbc-crc` and `des-cbc-md5`) at their own risk. To disable a subset of the weak etypes, users can list preferred etypes explicitly in any of the `default_tkt_enctypes`, `default_tgs_enctypes`, or `permitted_enctypes` settings. security-libs/java.security: JDK-8295894: Removed SECOM Trust System's RootCA1 Root Certificate The following root certificate from SECOM Trust System has been removed from the `cacerts` keystore: ``` + alias name "secomscrootca1 [jdk]" Distinguished Name: OU=Security Communication RootCA1, O=SECOM Trust.net, C=JP ``` JDK-8314960: Added Certigna Root CA Certificate The following root certificate has been added to the cacerts truststore: ``` + Certigna (Dhimyotis) + certignarootca DN: CN=Certigna Root CA, OU=0002 48146308100036, O=Dhimyotis, C=FR ``` ALL FIXED ISSUES, BY COMPONENT AND PRIORITY: client-libs: (P4) JDK-8232225: Rework the fix for JDK-8071483 client-libs/java.awt: (P2) JDK-8214046: [macosx] Undecorated Frame does not Iconify when set to (P2) JDK-8295685: Update Libpng to 1.6.38 (P4) JDK-8209115: adjust libsplashscreen linux ppc64le builds for easier libpng update (P4) JDK-8253269: The CheckCommonColors test should provide more info on failure core-libs: (P3) JDK-8287663: Add a regression test for JDK-8287073 (P4) JDK-8287073: NPE from CgroupV2Subsystem.getInstance() core-libs/java.net: (P4) JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails intermittently due to NumberFormatException core-libs/java.util.jar: (P3) JDK-8315135: Memory leak in the native implementation of Pack200.Unpacker.unpack() (P3) JDK-8173072: zipfs fails to handle incorrect info-zip "extended timestamp extra field" core-libs/java.util:collections: (P4) JDK-8205399: Set node color on pinned HashMap.TreeNode deletion hotspot/compiler: (P2) JDK-8202952: C2: Unexpected dead nodes after matching (P3) JDK-8283441: C2: segmentation fault in ciMethodBlocks::make_block_at(int) hotspot/runtime: (P4) JDK-8310026: [8u] make java_lang_String::hash_code consistent across platforms infrastructure/build: (P4) JDK-8309143: [8u] fix archiving inconsistencies in GHA infrastructure/release_eng: (P4) JDK-8309122: Bump update version of OpenJDK: 8u392 security-libs/java.security: (P2) JDK-8314960: Add Certigna Root CA - 2 (P3) JDK-8295894: Remove SECOM certificate that is expiring in September 2023 (P4) JDK-8317040: Exclude cleaner test failing on older releases security-libs/javax.security: (P3) JDK-8242330: Arrays should be cloned in several JAAS Callback classes (P3) JDK-8284910: Buffer clean in PasswordCallback security-libs/org.ietf.jgss: (P3) JDK-8225687: Newly added sspi.cpp in JDK-6722928 still contains some small errors (P3) JDK-6722928: Provide a default native GSS-API library on Windows (P4) JDK-8200468: Port the native GSS-API bridge to Windows security-libs/org.ietf.jgss:krb5: (P3) JDK-8139348: Deprecate 3DES and RC4 in Kerberos