What is the roadmap for the Java versions being used in BFI and VMM Manager? The jre for BFI is at 17.0 VMM Manager is at 1.80. When would HCL be moving to a newer version like 21?
1 Like
Java 21 is on the way for both BFI and VM Manager Tool, currently under performance verification. Current outlook is to release in upcoming 11.0.8 release. Please check the official Release Notes if it was included.
1 Like
Hi @ArturZ it appears the 11.0.8 doesn't include Java 21, per the release notes. Is this set for 11.0.9 now?
Hi! It was updated to 21.
IBM Java Runtime Environment updated to IBM Semeru Runtime Open Edition 21.0.10.1 in the following components:
- BigFix Inventory Server
- BigFix Inventory VM Manager Tool
- SAP Metric Data Collector
- BigFix Inventory Image Scanning Service
- BigFix Inventory Cloud Adapter
See Release Notes and Security Enhancements section: BigFix-Inventory-11.0.8.0-ReleaseNotes.docx
1 Like
hi @ArturZ, that’s good but it still a bit short and more to be desired as a solution. I think all BigFix products need to offer somehow “update java" process outside of upgrading the product because Java nowadays have a lot more vulnerabilities that we need to content with and are released at a greater frequency, so can’t always wait 3 months for the next release. For example, IBM Semeru 21.0.10 was released end of February, there are already one full version and one beta released (21.0.12) and some of those carry vulnerabilities… I just raised equivalent support case with regards to IVR4 for Qualys cause they told me “next version is due Sep 30th and will take care of it”, well, that’s fine but I can’t tell my Security team we need to wait a few months before we can remediate those vulnerabilities… Imagine, tomorrow Java drops CVE with CVSS score of 10, what process would be in place to deal with something like that…?
1 Like
Yes and I would even expand that to cover any part of the application, not only Java. We are looking for something more generic and lightweight to release security fixes faster when needed.
Sometimes, like it was with the recent Java 17 versions, we were having situation when new version was addressing the CVEs, but introducing the stability issue. At that time we took the decision to stay with older version that provides stability.
Move to Java 21 requires changes to BFI itself. Sometimes even fix packs can introduce some changes that needs application adjustments. So it is not always only just replacing JRE or other component, but making adjustment in code or configuration are needed as well.
BigFix Inventory is committed to release the update when there will be critical CVE. So in the case of critical CVE, we will create a build on top of the previous version just with the security fix and released ASAP.
Yesterday, we have released update to 7-Zip we are using in BigFix Inventory / BigFix Scanner sites due to CVE.
2 Likes
Glad that you have it on your radar and hopefully it will be delivered sooner rather than later. Hopefully the other components of BigFix are aligning with the same too!
Thank you for the link @ArturZ.