Payara Community Version 5.2022.3 is out today, bringing concurrency enhancements previously seen in Enterprise and a key security fix, solving the recently discovered CVE-2022-37422. You must update your environments to the latest version to be safe.
Payara Community Version 5.2022.3 brings 10 bug fixes, 6 component updates, 7 improvements and 1 key security fix.
You can download Payara Community Version 5.2022.3here.
You Must Update – CVE-2022-37422
There is a recently detected a 0-day vulnerability in all distributions of the Payara Platform that affects web applications that are deployed in the default context root(/). To this effect, we have prepared a fix.
All Payara users must update their environment as soon as possible to remain safe. The safe versions are:
Payara Enterprise 5.42.0
Payara Community 5.2022.3
Payara Enterprise 4.1.2.191.36
Not out yet, but coming soon:
Payara Community 6.2022.1.Alpha4
We would like to credit and give thanks to Marcin Dudek (@dudekmar) who originally reported the issue.
Payara Community Receives Concurrency Enhancements
Payara-resources.xml already allowed several different types of resources to be defined within it. Now, ManagedExecutorServices is one of them.This allows you to create concurrent ManagedExecutor resources automatically when the .ear or .jar that needs them is deployed.
You can also now use ForkJoinPool for Managed Executor Services.
However, please note, that Payara 5 Community will soon be discontinued and the only safe way to use these enhancements will be with Payara 6 Community or Payara 5 Enterprise – find out more here.
Enterprise Users: Payara 4.x Extended Maintenance
Today also sees the release of Payara 4.1.2.191.36. This is the last release before it enters its Extended Support phase. You have been emailed about this but monthly patches will stop being released for the current minor version, and we’ll stop implementing hotfixes and backport fixes for releases older than 4.1.2.191. Please upgrade your environments and contact our support team via the usual channels with any questions.
Webinar – Move Your GlassFish Upstream: What You Need to Know About Migration
If you are reading this, it is likely you are already using Payara Platform – but if you still have applications or projects in GlassFish, or know people who do, it’s time to make the change.
Previously scheduled for July, the webinar has now been rearranged for August 24, 3.00 PM BST.
Make sure you re-sign up:
Release Notes
Payara Community Version 5.2022.3 brings 10 bug fixes, 6 component updates, 7 improvements and 1 key security fix.
See a more detailed overview in the Release Notes:
3 minutes
The CVE-2022-37422 vulnerability only affects version 5.2022.2?
Unfortunately it seems very likely it will affect some older versions as well.