Chapter 3. Red Hat build of OpenJDK 8.0.392 release notes The latest Red Hat build of OpenJDK 8 release might include new features. Additionally, the latest release might enhance, deprecate, or remove features that originated from Red Hat build of OpenJDK 8 releases. Note For all the other changes and security fixes, see OpenJDK 8u392 Released . 3.1. Red Hat build of OpenJDK new features and enhancements Review the following release notes to understand new features and feature enhancements that Red Hat build of OpenJDK 8.0.392 provides: Improved communication in CORBA The Common Object Request Broker Architecture (CORBA) implementation in Red Hat build of OpenJDK now provides the option to limit serialization in stub objects to objects containing the IOR: prefix. Consider the following guidelines: For the following ORB-contrained stub classes, this feature is enabled by default: _DynArrayStub _DynEnumStub _DynFixedStub _DynSequenceStub _DynStructStub _DynUnionStub _DynValueStub _DynAnyStub _DynAnyFactoryStub You can disable this feature for ORB-constrained stub classes by setting the org.omg.DynamicAny.disableIORCheck system property to true . For the following remote service stub classes, this feature is disabled by default: _NamingContextStub _BindingIteratorStub _NamingContextExtStub _ServantActivatorStub _ServantLocatorStub _ServerManagerStub _ActivatorStub _RepositoryStub _InitialNameServiceStub _LocatorStub _ServerStub You can enable this feature for remote service stub classes by setting the org.omg.CORBA.IDL.Stubs.enableIORCheck system property to true . JDK bug system reference ID: JDK-8303384. Default native GSS-API library added on Windows Red Hat build of OpenJDK 8.0.392 adds a native Generic Security Service Application Programming Interface (GSS-API) library, sspi_bridge.dll , on the Windows platform. Similar to the provision of native GSS-API libraries on other operating systems, Red Hat build of OpenJDK loads the sspi_bridge.dll library only when the sun.security.jgss.native system property is set to true . Alternatively, you can still instruct the JDK to load a third-party native GSS-API library by setting the sun.security.jgss.lib system property to the appropriate path. The sspi_bridge.dll library is for client-side use only and uses the default credentials. Because native GSS support automatically uses cached credentials from the underlying operating system, ensure that you set the javax.security.auth.useSubjectCredsOnly system property to false . Also, because com.sun.security.auth.module.Krb5LoginModule does not call the native Java GSS (JGSS), avoid using Krb5LoginModule in your Java Authentication and Authorization Service (JAAS) configuration. See JDK-6722928 (JDK Bug System) . Certigna root CA certificate added In Red Hat build of OpenJDK 8.0.392, the cacerts truststore includes the Certigna root certificate: Name: Certigna (Dhimyotis) Alias name: certignarootca Distinguished name: CN=Certigna Root CA, OU=0002 48146308100036, O=Dhimyotis, C=FR See JDK-8314960 (JDK Bug System) . Arrays cloned in several JAAS callback classes In releases, in the ChoiceCallback and ConfirmationCallback JAAS classes, when arrays were passed into a constructor or returned, these arrays were not cloned. This behavior allowed an external program to gain access to the internal fields of these classes. In Red Hat build of OpenJDK 8.0.392, the JAAS classes return cloned arrays. See JDK-8242330 (JDK Bug System) . 3.2. Red Hat build of OpenJDK deprecated features Review the following release notes to understand pre-existing features that have been either deprecated or removed in Red Hat build of OpenJDK 8.0.392: 3DES and RC4 disabled in Kerberos Red Hat build of OpenJDK 8.0.392 deprecates and disables the des3-hmac-sha1 and rc4-hmac Kerberos encryption types by default. If you want to re-enable these encryption types, complete either of the following actions: Enable all weak cryptography, including des-cbc-crc and and des-cbc-md5 , by setting allow_weak_crypto = true in the krb5.conf configuration file. Explicitly list all preferred encryption types by using the default_tkt_enctypes , default_tgs_enctypes , or permitted_enctypes settings. See JDK-8139348 (JDK Bug System) . SECOM Trust Systems root CA1 certificate removed From Red Hat build of OpenJDK 8.0.392 onward, the cacerts truststore no longer includes the SECOM Trust Systems root certificate: Alias name: secomscrootca1 [jdk] Distinguished name: OU=Security Communication RootCA1, O=SECOM Trust.net, C=JP See JDK-8295894 (JDK Bug System) .

Commands: