Liberica JDK 11.0.21+10: Release Notes

1. Version information

This document provides information about Liberica JDK 11.0.21 release.

The full version string for this update release is 11.0.21+10. The version number is 11.

Liberica JDK 11 is distributed as .apk, .rpm, .zip, .deb, and .tar.gz packages. Please select the most appropriate for your purposes.

2. What’s New

This release contains the following updates and new features.

Notable Changes

This is the list of the notable issues fixed in this release.

Issue ID

JDK-8306412

Summary: Use server cipher suites preference by default

Description: The server now uses its cipher suite preference so that it can have more control over the security parameters of each connection.

JDK-8310125

Summary: Throw error if default java.security file is missing

Description: If the java.security file is missing from a JDK/JRE install, the JDK now thows an error instead of simply reverting to a minimal/old set of security configuration settings.

JDK-8310202

Summary: JCE did not provide any class to handle RSA private key in PKCS#1

Description: It was not possible to read RSA private key in PKCS #1 using Sun JCE. A factory was added to read PKCS#1 encoded private key.

JDK-8310509

Summary: KeyStore of type KeychainStore provider Apple did not show all trusted certificates

Description: JDK-8278449 changed the behavior of the MacOS Keystore implementation (KeychainStore, provider "Apple") to only show certificates with proper trust. However, the implementation did not show all possible trusted certificates. Certificates were only loaded if a trust record in the "user domain" existed. This was not sufficient as there might as well be records in the domains "admin" or "system".

JDK-8311496

Summary: Have -XshowSettings option display tzdata version

Description: The -XshowSettings:all option now displays the tzdata version along with other information.

JDK-8311770

Summary: Increased the default TLS Diffie-Hellman group size from 1024-bit to 2048-bit

Description: The JDK implementation of TLS 1.2 used a DH keysize of 1024 bits (chosen by the server) when a TLS_DHE cipher suite was negotiated and either the client or server did not support FFDHE to negotiate a stronger keysize. The 1024-bit DH keys are known to be weak and are no longer recommended.

JDK-8312541

Summary: Removed SECOM certificate that expired in September 2023

Description: A SECOM certificate (OU=Security Communication RootCA1, O=SECOM Trust.net, C=JP) expiring in September 2023 was removed.

JDK-8314664

Summary: Invalid CEN header (invalid zip64 extra data field size)

Description: The following ZipException was thrown when the data contained in the CEN Extra fields was ambiguous: Invalid CEN header (invalid zip64 extra data field size).

JDK-8315608

Summary: Added Certigna Root CA - 2

Description: The Certinga root certificate has been added to the cacerts truststore.

Graal support in Liberica JDK 11

Liberica JDK continues to provide support for AOT and Graal JIT. Since in OpenJDK 11 builds these features are deemed experimental and deprecated, it is recommended to compile native executables with Liberica Native Image Kit to avoid errors.

IANA TZ Data update

This release of Liberica JDK 11.0.21 comes with IANA Time Zone Database version 2024a. The following are the main changes in this update:

Kazakhstan unifies on UTC+5 beginning 2024-03-01. Palestine springs forward a week later after Ramadan. zic no longer pretends to support indefinite-past DST. localtime no longer mishandles Ciudad Juárez in 2422.

3. Known Issues

This release does not contain any known issues.

4. Fixed CVEs

This is the list of the security issues fixed in this release. CVSS scores are provided using the CVSS version 3.1 scoring system.

CVE IDCVSS scoreComponentModuleAttack VectorComplexityPrivilegesUser InteractionScopeConfidentialityIntegrityAvailability

CVE-2023-22081

5.3

security-libs

javax.net.ssl

network

low

none

none

unchanged

none

none

low

5. Resolved Issues

JDK issues

This is the list of general JDK issues fixed in this release.

Issue IDSummary

JDK-6176679

Application freezes when copying an animated gif image to the system clipboard

JDK-8023980

JCE doesn’t provide any class to handle RSA private key in PKCS#1

JDK-8155246

Throw error if default java.security file is missing

JDK-8158880

test/java/time/tck/java/time/format/TCKDateTimeFormatterBuilder.java fail with zh_CN locale

JDK-8168261

Use server cipher suites preference by default

JDK-8181383

com/sun/jdi/OptionTest.java fails intermittently with bind failed: Address already in use

JDK-8201516

DebugNonSafepoints generates incorrect information

JDK-8209398

sun/security/pkcs11/KeyStore/SecretKeysBasic.sh failed with "PKCS11Exception: CKR_ATTRIBUTE_SENSITIVE"

JDK-8211343

nsk_jvmti_parseoptions should handle multiple suboptions

JDK-8212045

Add back the tests that were removed from HashesTest.java and AddExportsTest.java

JDK-8216059

nsk_jvmti_parseoptions still has dependency on tilde separator

JDK-8217237

HttpClient does not deal well with multi-valued WWW-Authenticate challenge headers

JDK-8217395

Update langtools shell tests to use ${EXE_SUFFIX}

JDK-8217612

(CL)HSDB cannot show some JVM flags

JDK-8217850

CompressedClassSpaceSizeInJmapHeap fails after JDK-8217612

JDK-8218471

generate-unsafe-access-tests.sh does not correctly invoke build.tools.spp.Spp

JDK-8219628

[TESTBUG] javadoc/doclet/InheritDocForUserTags fails with -othervm

JDK-8220410

sun/security/tools/jarsigner/warnings/NoTimestampTest.java failed with missing expected output

JDK-8221372

Test vmTestbase/nsk/jvmti/GetThreadState/thrstat001/TestDescription.java times out

JDK-8222323

ChildAlwaysOnTopTest.java fails with "RuntimeException: Failed to unset alwaysOnTop"

JDK-8223573

Replace wildcard address with loopback or local host in tests - part 4

JDK-8223714

HTTPSetAuthenticatorTest could be made more resilient

JDK-8223783

sun/net/www/http/HttpClient/MultiThreadTest.java sometimes detect threads+1 connections

JDK-8223856

Replace wildcard address with loopback or local host in tests - part 8

JDK-8224617

(fs) java/nio/file/FileStore/Basic.java found filesystem twice

JDK-8224729

Cleanups in sun/security/provider/certpath/ldap/LDAPCertStoreImpl.java

JDK-8224768

Test ActalisCA.java fails

JDK-8225012

sanity/client/SwingSet/src/ToolTipDemoTest.java fails on Windows

JDK-8226221

Update PKCS11 tests to use NSS 3.46 libs

JDK-8228341

SignTwice.java fails intermittently on Windows

JDK-8228403

SignTwice.java failed with java.io.FileNotFoundException: File name too long

JDK-8229147

Linux os::create_thread() overcounts guardpage size with newer glibc (>=2.27)

JDK-8229333

java/io/File/SetLastModified.java timed out

JDK-8229338

clean up test/jdk/java/util/RandomAccess/Basic.java

JDK-8229348

java/net/DatagramSocket/UnreferencedDatagramSockets.java fails intermittently

JDK-8229481

sun/net/www/protocol/https/ChunkedOutputStream.java failed with a SSLException

JDK-8229912

[TESTBUG] java/net/Socks/SocksIPv6Test fails without IPv6

JDK-8230132

java/net/NetworkInterface/NetworkInterfaceRetrievalTests.java to skip Teredo Tunneling Pseudo-Interface

JDK-8231037

java/net/InetAddress/ptr/Lookup.java fails intermittently due to reverse lookup failed

JDK-8231357

sun/security/pkcs11/Cipher/TestKATForGCM.java fails on SLES11 using mozilla-nss-3.14

JDK-8231516

network QuickAckTest.java failed due to "SocketException: maximum number of DatagramSockets reached"

JDK-8232101

(sctp) Add minimal sanity tests for SCTP

JDK-8232195

Enable BigInteger tests: DivisionOverflow, SymmetricRangeTests and StringConstructorOverflow

JDK-8232840

java/math/BigInteger/largeMemory/SymmetricRangeTests.java fails due to "OutOfMemoryError: Requested array size exceeds VM limit"

JDK-8232922

Add java/math/BigInteger/largeMemory/SymmetricRangeTests.java to ProblemList-Xcomp

JDK-8234808

jdb quoted option parsing broken

JDK-8236045

[TESTBUG] MismatchedWhiteBox test fails with missing WhiteBox$WhiteBoxPermission.class

JDK-8237183

Bug ID missing for test in patch which fixed JDK-8230665

JDK-8238157

security/infra/java/security/cert/CertPathValidator/certification/AmazonCA.java test failures because of revocation date

JDK-8239007

java/math/BigInteger/largeMemory/ tests should be disabled on 32-bit platforms

JDK-8239264

Clearup the legacy ObjectIdentifier constructor from int array

JDK-8239333

Mark test AmazonCA.java with intermittent key

JDK-8239537

cgroup MetricsTester testMemorySubsystem fails sometimes when testing memory.kmem.tcp.usage_in_bytes

JDK-8240193

loadLibrary("osxsecurity") should not be removed

JDK-8241097

java/math/BigInteger/largeMemory/SymmetricRangeTests.java requires -XX:+CompactStrings

JDK-8242151

Improve OID mapping and reuse among JDK security providers for aliases registration

JDK-8242330

Arrays should be cloned in several JAAS Callback classes

JDK-8242897

KeyFactory.generatePublic( x509Spec ) failed with java.security.InvalidKeyException

JDK-8243210

ClhsdbScanOops fails with NullPointerException in FileMapHeader.inCopiedVtableSpace

JDK-8244078

ProcessTools executeTestJvm and createJavaProcessBuilder have inconsistent handling of test.*.opts

JDK-8247895

SHA1PRNGReseed.java is calling setSeed(0)

JDK-8247968

test/jdk/javax/crypto/SecretKeyFactory/security.properties has wrong header

JDK-8248001

javadoc generates invalid HTML pages whose ftp:// links are broken

JDK-8249699

java/io/ByteArrayOutputStream/MaxCapacity.java should use @requires instead of @ignore

JDK-8251517

[TESTBUG] com/sun/net/httpserver/bugs/B6393710.java does not scale socket timeout

JDK-8252530

Fix inconsistencies in hotspot whitebox

JDK-8254350

CompletableFuture.get may swallow InterruptedException

JDK-8255348

NPE in PKIXCertPathValidator event logging code

JDK-8257993

vmTestbase/nsk/jvmti/RedefineClasses/StressRedefine/TestDescription.java crash intermittently

JDK-8259796

timed CompletableFuture.get may swallow InterruptedException

JDK-8260274

Cipher.init(int, key) does not use highest priority provider for random bytes

JDK-8260878

com/sun/jdi/JdbOptions.java fails without jfr

JDK-8260934

java/lang/StringBuilder/HugeCapacity.java fails without Compact Strings

JDK-8263970

Manual test javax/swing/JTextField/JapaneseReadingAttributes/JapaneseReadingAttributes.java failed

JDK-8265980

Fix systemDictionary and loaderConstraints printing

JDK-8268457

XML Transformer outputs Unicode supplementary character incorrectly to HTML

JDK-8268464

Remove dependancy of TestHttpsServer, HttpTransaction, HttpCallback from open/test/jdk/sun/net/www/protocol/https/ tests

JDK-8269091

javax/sound/sampled/Clip/SetPositionHang.java failed with ArrayIndexOutOfBoundsException: Array index out of range: -4

JDK-8270331

[TESTBUG] Error: Not a test or directory containing tests: java/awt/print/PrinterJob/InitToBlack.java

JDK-8271838

AmazonCA.java interop test fails

JDK-8273807

Zero: Drop incorrect test block from compiler/startup/NumCompilerThreadsCheck.java

JDK-8274205

Handle KDC_ERR_SVC_UNAVAILABLE error code from KDC

JDK-8274606

Fix jaxp/javax/xml/jaxp/unittest/transform/SurrogateTest.java test

JDK-8275234

java/awt/GraphicsDevice/DisplayModes/CycleDMImage.java is entered twice in ProblemList

JDK-8275303

sun/java2d/pipe/InterpolationQualityTest.java fails with D3D basic render driver

JDK-8276651

java/lang/ProcessHandle tests fail with "RuntimeException: Input/output error" in java.lang.ProcessHandleImpl$Info.info0

JDK-8277353

java/security/MessageDigest/ThreadSafetyTest.java test times out

JDK-8279536

jdk/nio/zipfs/ZipFSOutputStreamTest.java timed out

JDK-8283756

(zipfs) ZipFSOutputStreamTest.testOutputStream should only check inflated bytes

JDK-8284524

Create an automated test for JDK-4422362

JDK-8284767

Create an automated test for JDK-4422535

JDK-8284772

GHA: Use GCC Major Version Dependencies Only

JDK-8284910

Buffer clean in PasswordCallback

JDK-8285635

javax/swing/JRootPane/DefaultButtonTest.java failed with Default Button not pressed for L&F: com.sun.java.swing.plaf.motif.MotifLookAndFeel

JDK-8286172

Create an automated test for JDK-4516019

JDK-8286481

Exception printed to stdout on Windows when storing transparent image in clipboard

JDK-8286503

Enhance security classes

JDK-8286620

Create regression test for verifying setMargin() of JRadioButton

JDK-8289508

Improve test coverage for XPath Axes: ancestor, ancestor-or-self, preceding, and preceding-sibling

JDK-8289748

C2 compiled code crashes with SIGFPE with -XX:+StressLCM and -XX:+StressGCM

JDK-8291444

GHA builds/tests won’t run manually if disabled from automatic running

JDK-8291830

jvmti/RedefineClasses/StressRedefine failed: assert(!is_null(v)) failed: narrow klass value can never be zero

JDK-8292033

Move jdk.X509Certificate event logic to JCA layer

JDK-8292297

Fix up loading of override java.security properties file

JDK-8292443

Weak CAS VarHandle/Unsafe tests should test always-failing cases

JDK-8293180

JQuery UI license file not updated

JDK-8293562

KeepAliveCache Blocks Threads while Closing Connections

JDK-8293657

sun/management/jmxremote/bootstrap/RmiBootstrapTest.java#id1 failed with "SSLHandshakeException: Remote host terminated the handshake"

JDK-8293858

Change PKCS7 code to use default SecureRandom impl instead of SHA1PRNG

JDK-8295737

macOS: Print content cut off when width > height with portrait orientation

JDK-8295894

Remove SECOM certificate that is expiring in September 2023

JDK-8296084

javax/swing/JSpinner/4788637/bug4788637.java fails intermittently on a VM

JDK-8296581

Better system proxy support

JDK-8297437

javadoc cannot link to old docs (with old style anchors)

JDK-8297523

Various GetPrimitiveArrayCritical miss result - NULL check

JDK-8297587

Upgrade JLine to 3.22.0

JDK-8297681

Unnecessary color conversion during 4BYTE_ABGR_PRE to INT_ARGB_PRE blit

JDK-8297730

C2: Arraycopy intrinsic throws incorrect exception

JDK-8297856

Improve handling of Bidi characters

JDK-8297887

Update Siphash

JDK-8297923

java.awt.ScrollPane broken after multiple scroll up/down

JDK-8297955

LDAP CertStore should use LdapName and not String for DNs

JDK-8298921

Create a regression test for JDK-8139581

JDK-8298974

Add ftcolor.c to imported freetype sources

JDK-8299424

containers/docker/TestMemoryWithCgroupV1.java fails on SLES12 ppc64le when testing Memory and Swap Limit

JDK-8299658

C1 compilation crashes in LinearScan::resolve_exception_edge

JDK-8299713

Test javax/swing/JTableHeader/6889007/bug6889007.java failed: Wrong type of cursor

JDK-8300098

java/util/concurrent/ConcurrentHashMap/ConcurrentAssociateTest.java fails with internal timeout when executed with TieredCompilation1/3

JDK-8300659

Refactor TestMemoryAwareness to use WhiteBox api for host values

JDK-8300751

[17u] Remove duplicate entry in javac.properties

JDK-8301269

Update Commons BCEL to Version 6.7.0

JDK-8301491

C2: java.lang.StringUTF16::indexOfChar intrinsic called with negative character argument

JDK-8301700

Increase the default TLS Diffie-Hellman group size from 1024-bit to 2048-bit

JDK-8301959

Compile command in compiler.loopopts.TestRemoveEmptyCountedLoop does not work

JDK-8302161

Upgrade jQuery UI to version 1.13.2

JDK-8302182

Update Public Suffix List to 88467c9

JDK-8303511

C2: assert(get_ctrl(n) == cle_out) during unrolling

JDK-8303809

Dispose context in SPNEGO NegotiatorImpl

JDK-8304054

Linux: NullPointerException from FontConfiguration.getVersion in case no fonts are installed

JDK-8304498

JShell does not switch to raw mode when there is no /bin/test

JDK-8304867

Explicitly disable dtrace for ppc builds

JDK-8305074

ProblemList javax/net/ssl/DTLS/RespondToRetransmit.java

JDK-8305421

Work around JDK-8305420 in CDSJDITest.java

JDK-8305763

Parsing a URI with an underscore goes through a silent exception, negatively impacting performance

JDK-8305766

ProblemList runtime/CompressedOops/CompressedClassPointers.java

JDK-8305815

Update Libpng to 1.6.39

JDK-8305950

Have -XshowSettings option display tzdata version

JDK-8306133

Open source few AWT Drag & Drop related tests

JDK-8306137

Open source several AWT ScrollPane related tests

JDK-8306484

Open source several AWT Choice jtreg tests

JDK-8306636

Disable compiler/c2/Test6905845.java with -XX:TieredStopAtLevel=3

JDK-8306638

Open source some AWT tests related to datatransfer and Toolkit

JDK-8306682

Open source a few more AWT Choice tests

JDK-8306718

Optimize and opensource some old AWT tests

JDK-8306881

Update FreeType to 2.13.0

JDK-8306954

Open source five Focus related tests

JDK-8306955

Open source several JComboBox jtreg tests

JDK-8307078

Opensource and clean up five more AWT Focus related tests

JDK-8307080

Open source some more JComboBox jtreg tests

JDK-8307128

Open source some drag and drop tests 4

JDK-8307133

Open source some JTable jtreg tests

JDK-8307135

java/awt/dnd/NotReallySerializableTest/NotReallySerializableTest.java failed

JDK-8307301

Update HarfBuzz to 7.2.0

JDK-8307569

Build with gcc8 is broken after JDK-8307301

JDK-8307572

AArch64: Vector registers are clobbered by some macroassemblers

JDK-8307603

[AIX] Broken build after JDK-8307301

JDK-8307604

gcc12 based Alpine build broken build after JDK-8307301

JDK-8307799

Newly added java/awt/dnd/MozillaDnDTest.java has invalid jtreg @requires clause

JDK-8308156

VerifyCACerts.java misses blank in error output

JDK-8309088

security/infra/java/security/cert/CertPathValidator/certification/AmazonCA.java fails

JDK-8309108

Bump update version for OpenJDK: jdk-11.0.21

JDK-8309138

Fix container tests for jdks with symlinked conf dir

JDK-8309966

Enhanced TLS connections

JDK-8310054

ScrollPane insets are incorrect

JDK-8310176

JDK 11 G1 crash during full GC with +UseStringDeduplication

JDK-8310620

[11u] Problemlist failing aot tests on macos x64

JDK-8311033

[macos] PrinterJob does not take into account Sides attribute

JDK-8311689

Wrong visible amount in Adjustable of ScrollPane

JDK-8312138

jcmd VM.metaspace vslist has no newline character before the Class: label.

JDK-8312555

Ideographic characters aren’t stretched by AffineTransform.scale(2, 1)

JDK-8313159

[11u] Fix test SSLEngineKeyLimit.java after Merge error

JDK-8313765

Invalid CEN header (invalid zip64 extra data field size)

JDK-8313796

AsyncGetCallTrace crash on unreadable interpreter method pointer

JDK-8313803

[11u] Exclude jdk/jfr/event/sampling/TestStackFrameLineNumbers.java

JDK-8313878

Exclude two compiler/rtm/locking tests on ppc64le

JDK-8314086

[11u] A typo in the fix for JDK-8312462 is causing test failure in ChildAlwaysOnTopTest.java

JDK-8314950

CMS may miss NMT tag after mark stack expansion

JDK-8314960

Add Certigna Root CA - 2

JDK-8315135

Memory leak in the native implementation of Pack200.Unpacker.unpack()

JDK-8315529

[11u] Exclude some failing Z-GC tests

JDK-8317040

Exclude cleaner test failing on older releases

JFX issues

This is the list of JFX issues fixed in this release.

Issue IDSummary

JDK-8251483

TableCell: NPE on modifying item’s list

JDK-8289751

Multiple unit test failures after JDK-8251483

JDK-8303680

Virtual Flow freezes after calling scrollTo and scrollPixels in succession

JDK-8303748

WebKit build fails with Visual Studio 2022 17.5.0

JDK-8304665

Change to Xcode12.4+1.1 devkit

JDK-8306329

Update ICU4C to 73.1

JDK-8307960

Create Table Column PopupMenu lazily

JDK-8308306

Update to Xcode 14.3 on macOS

JDK-8308307

Update to gcc 12.2.0 on Linux

JDK-8308308

Update to Visual Studio 2022 version 17.5.0 on Windows

JDK-8310681

Update WebKit to 616.1

JDK-8311097

Synchron XMLHttpRequest not receiving data

JDK-8313177

Web Workers timeout with Webkit 616.1

JDK-8313181

Enabling modern media controls on webkit 616.1 does not load button images on HTML5 video Element

JDK-8313711

Cherry-pick WebKit 616.1 stabilization fixes

JDK-8314212

Crash when loading cnn.com in WebView

JDK-8315657

Application window not activated in macOS 14 Sonoma

6. Updates to Third Party Libraries

This release does not contain any changes in the third party libraries.

7. Upgrading to the New Version

To keep your Liberica JDK up-to-date and secure, always upgrade to the newest available version once it is released. To upgrade, install the new version over the previous one. For the installation instructions, see Liberica JDK Installation Guide.

ON THIS PAGE