The following expired root certificate has been removed from the cacerts keystore:

+ alias name "baltimorecybertrustca [jdk]"

  Distinguished Name: CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE

The following root certificates, which are terminated and no longer in use, have been removed from the cacerts keystore:

+ alias name "camerfirmachamberscommerceca [jdk]"

  Distinguished Name: CN=Chambers of Commerce Root, OU=http://www.chambersign.org, O=AC Camerfirma SA CIF A82743287, C=EU

+ alias name "camerfirmachambersignca [jdk]"
  Distinguished Name: CN=Global Chambersign Root - 2008, O=AC Camerfirma S.A., SERIALNUMBER=A82743287, L=Madrid (see current address at www.camerfirma.com/address), C=EU

The following root certificates have been added to the cacerts truststore:

+ Sectigo Limited

  + sectigocodesignroote46
    DN: CN=Sectigo Public Code Signing Root E46, O=Sectigo Limited, C=GB

+ Sectigo Limited
  + sectigocodesignrootr46
    DN: CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB

+ Sectigo Limited
  + sectigotlsroote46
    DN: CN=Sectigo Public Server Authentication Root E46, O=Sectigo Limited, C=GB

+ Sectigo Limited
  + sectigotlsrootr46
    DN: CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB

The oracle.com JDK RPM packages meant to be downloaded directly to the target system, now are signed with the OL9 signing key instead of the OL8 signing key. The RPM packages hosted on YUM repositories remain signed with the appropriate key for the target repository.

In this release, the JDK implementation of the LDAP provider no longer supports deserialization of Java objects by default:

• The default value of the com.sun.jndi.ldap.object.trustSerialData system property has been updated to false.

The transparent deserialization of Java objects from an LDAP context will now require an explicit opt-in. Applications that rely on reconstruction of Java objects or RMI stubs from the LDAP attributes would need to set the com.sun.jndi.ldap.object.trustSerialData system property to true.

In prior releases, JNI_GetCreatedJavaVMs:

jint JNI_GetCreatedJavaVMs(JavaVM **vmBuf, jsize bufLen, jsize *nVMs);

could return a JavaVM, via the vmBuf array, that was still in the process of being initialized and may not be ready for use. This has now changed so that it will only return fully initialized VMs. It is important that the programmer checks that the returned number of VMs, in nVMs, is greater than zero, before trying to use any vmBuf entries.

If an entry is removed from a signed JAR file, there is no mechanism to detect that it has been removed using the JarFile API, since the getJarEntry method returns null as if the entry had never existed. With this change, the jarsigner -verify command analyzes the signature files and if some sections do not have matching file entries, it prints out the following warning: "This JAR contains signed entries for files that do not exist". Users can further find out the names of these entries by adding the -verbose option to the command.