Release notes - Payara Platform Community 6.2022.1

Supported APIs and Applications

  • Jakarta EE 10

  • Jakarta EE 10 Applications

  • MicroProfile 5

Security Vulnerability

We have been made aware of a 0-day vulnerability. This vulnerability exploit opens up to attackers a way to explore the contents of the WEB-INF and META-INF folders if an application is deployed to the root context. This vulnerability is similar to another 0-day vulnerability (CVE-2022-37422) we recently had. We would like to thank Michael Baer, Luc Créti and Jean-Michel Lenotte, all working for Atos, for alerting us to this vulnerability. You must upgrade to this latest version of Payara 6 Community to avoid the security issue.

Improvements

  • [FISH-372] Provide option to disable clustering functionality of Hazelcast on Payara Micro

  • [FISH-1336] Properly Shutdown Payara Micro on Ctrl+C

  • [FISH-5827] Stuck Thread count as MicroProfile Metric Gauge

  • [FISH-5828] Connection Pool Metrics Exposed as MicroProfile Metrics

  • [FISH-6434] Support OpenID Connect token issuer field in ADFS

Security Fix

  • [FISH-6603] 0-Day Vulnerability Exploit Using ROOT Context Deployments

Bug Fixes

  • [FISH-1418] JMX Service doesn’t start on JDK 8u292 and 11.0.11

  • [FISH-5806] Remove JobManager from Payara Server

  • [FISH-6238] Microprofile Interceptors @Fallback @CircuitBreaker are not getting invoked if the EJB is a @Stateless Bean

  • [FISH-6347] Fix Admin Console (Post Mojarra Upgrade)

  • [FISH-6430] TransactionScopedCDIEventHelperImpl Injection Error

  • [FISH-6435] Dynamic Proxy is not Used when Injecting Context Types into Singleton EJB

  • [FISH-6470] GCM Cipher Suites Not Being Recognized

  • [FISH-6481] CORBA Incorrectly opening an additional TCP socket on Windows systems

  • [FISH-6500] `hazelcast-configuration-file\` Domain Property Ignored

  • [FISH-6501] Commands in Postboot File Fail

  • [FISH-6506] Environment Variable Replacement in Payara Micro Logging Properties File Does Not Work

  • [FISH-6566] Unable to Restart Instance with Application containing JSON File

  • [FISH-6576] Jakarta EE 10 DDs schema definition file missing in Payara 6.x

Component Upgrades

  • [FISH-6357] Ensure No Longer Using Jakarta Milestone Components

  • [FISH-6543] Update JAXB Impl to 4.0.1