Upgrade Java 17

[robotdan]

Upgrade Java 17

Description

Upgrade Java to the most recent patch version of 17 LTS. Optionally review the state of Graal VM.

Tasks

• Update Java
• Consider using jlink in the start.sh and start.ps1 start scripts as well. This way the VM is exactly the same as in Docker.

Testing

• Fast path install (windows, linux, macOS)
• Docker
• RPM and Deb install testing

Related CVEs

Review available list of CVEs related to the JDK, while not necessarily vulnerable, updating the JDK will remove the CVEs from scanners.

• CVE-2022-34169
  • Not vulnerable. This feature / library is not utilized.
  • JDK, Apache Xalan Java XSLT
  • https://nvd.nist.gov/vuln/detail/CVE-2022-34169
• CVE-2022-21549
  • No known exploits.
  • GraalVM
  • https://nvd.nist.gov/vuln/detail/CVE-2022-21549
• CVE-2022-21541
  • No known exploits.
  • GraalVM
  • https://nvd.nist.gov/vuln/detail/CVE-2022-21541
• CVE-2022-21540
  • No known exploits.
  • GraalVM
  • https://nvd.nist.gov/vuln/detail/CVE-2022-21540

Related

• Update JDK 17 from 17.0.3+7 to latest (17.0.5+8) #1935
• Update deps #2385

Community guidelines

All issues filed in this repository must abide by the FusionAuth community guidelines.

Release Notes

Upgrade to the latest Java 17 LTS. Upgraded from 17.0.3+7 to 17.0.8+1.

[robotdan]

Internal:

• https://github.com/FusionAuth/fusionauth-app/pull/291
• Upgrade to Java 17.0.8+7 fusionauth-containers#91
• https://github.com/FusionAuth/fusionauth-search/pull/6

[spwitt]

Internal:

• https://github.com/FusionAuth/fusionauth-app/pull/328
• Upgrade to Java 17.0.8.1+1 fusionauth-containers#94
• https://github.com/FusionAuth/fusionauth-search/pull/8
• https://github.com/FusionAuth/fusionauth-developer/pull/7

[spwitt]

I started to investigate using jlink for VMs in other scripts as well. The issue is that we need to use the same VM for Elasticsearch. The Elasticsearch documentation lists necessary modules for a jlinked VM, but:

1. It includes java, which is not a module. This could be a typo for another module that should have been included
2. Using the jdeps tool to list dependencies for Elasticsearch includes some modules that are not referenced by this document

./java/current/bin/jdeps --multi-release 9 -cp './fusionauth-search/elasticsearch/lib/.*' -summary -recursive ./fusionauth-search/elasticsearch/lib/elasticsearch-7.6

The unlisted modules include:

java.desktop
java.rmi
java.scripting
java.xml
java.sql

Using jlink to limit modules at this time seems risky. I will continue with the Java upgrade and testing without using jlink.