JDK patching happens with every RU since January 2020

Posted on April 22, 2020 by Mike.Dietrich Patch Recommendation 27

A while ago, a customer asked me whether he needs to apply JDK patches separately. He discovered that the JDK in the $ORACLE_HOME is quite outdated. But there was no clear answer available. And the MOS Note he pointed me to, seemed to be quite incomplete. But times have changed. And JDK patching happens with every RU since January 2020.

Photo by David Billings on Unsplash

JDK who?

JDK stands for Java Development Toolkit. As the Wikipedia article explains, “the JDK includes a private JVM and a few other resources to finish the development of a Java Application”. And it is used by various Oracle tools. For instance, in AutoUpgrade we use the java loader for java binaries – and we do the same for the preupgrade.jar. OPatch delivers a JDK, too. And following a discussion earlier this year with Dominic Giles on JDK versions in our homes, I realized that my Oracle Homes don’t have necessarily the newest JDKs in them.

On this page you find the newest JDKs (you need to scroll down a bit):

Java SE Downloads

In Oracle 19c, we use JDK 1.8 – and the most recent, while I write this blog post, would be Java SE 8u251.

This is also the one you can download directly from MOS Note: 2584628.1 – JDK and PERL Patches for Oracle Database Home and Grid Home:

MOS Note: 2584628.1 – JDK and PERL Patches for Oracle Database Home and Grid Home

What is in my home?

Now I’m curious. I booted my old 18c hands-on lab as in the current one I have everything patched already to the April 2020 bundles. But which JDK versions will I find in the more-than-one-year-old lab?

At first, I check what my OS – in this case:

cat /etc/os-release

NAME="Oracle Linux Server" 
VERSION="6.10" 
ID="ol" 
VERSION_ID="6.10" 
PRETTY_NAME="Oracle Linux Server 6.10"

And it has the following JDK from the OS side:

oracle@localhost:/u01/app/oracle/product/11.2.0.4/jdk/bin
$ java -version
java version "1.7.0_221"
OpenJDK Runtime Environment (rhel-2.6.18.0.0.1.el6_10-x86_64 u221-b02)
OpenJDK 64-Bit Server VM (build 24.221-b02, mixed mode)

Afterwards, then I check my database homes:

Oracle 11.2.0.4 with PSU 11.2.0.4.180717

oracle@localhost:/u01/app/oracle/product/11.2.0.4/jdk/bin
$ ./java -version
java version "1.5.0_51"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_51-b10)
Java HotSpot(TM) 64-Bit Server VM (build 1.5.0_51-b10, mixed mode)

Oracle 12.1.0.2 with BP 12.1.0.2.191015

oracle@localhost:/u01/app/oracle/product/12.1.0.2/jdk/bin
$ ./java -version
java version "1.6.0_75"
Java(TM) SE Runtime Environment (build 1.6.0_75-b13)
Java HotSpot(TM) 64-Bit Server VM (build 20.75-b01, mixed mode)

Oracle 18c with RU 18.8.0.0.191015

oracle@localhost:/u01/app/oracle/product/18/jdk/bin
$ ./java -version
java version "1.8.0_171"
Java(TM) SE Runtime Environment (build 1.8.0_171-b11)
Java HotSpot(TM) 64-Bit Server VM (build 25.171-b11, mixed mode)

Now a quick check via any search engine reveals the release date of each JDK:

1.5.0_51 dates from June 2013
- The most recent available patch is from October 2015
- See MOS Note: 2584628.1 – JDK and PERL Patches for Oracle Database Home and Grid Home – you can update to a much newer and current JDK instead
1.6.0_75 dates from April 2014
- The most recent available patch is from October 2018
- See MOS Note: 2584628.1 – JDK and PERL Patches for Oracle Database Home and Grid Home – you can update to a much newer and recent JDK instead
1.8.0_171 dates from April 2018
- Please read further below – there is an important update as of January 2020
  .

Checking with the April 2020 Patch Bundles

I repeat the same test now in my current lab environment.

At first again, I check my operating system:

cat /etc/os-release

NAME="Oracle Linux Server"
VERSION="7.7"
ID="ol"
ID_LIKE="fedora"
VARIANT="Server"
VARIANT_ID="server"
VERSION_ID="7.7"
PRETTY_NAME="Oracle Linux Server 7.7"

As I update it on a regular basis, it has the following JDK deployed:

$ /usr/bin/java -version
openjdk version "1.8.0_242"
OpenJDK Runtime Environment (build 1.8.0_242-b08)
OpenJDK 64-Bit Server VM (build 25.242-b08, mixed mode)

Then I check the JDK versions in my 3 Oracle Homes. I patched them recently with the April 2020 bundle patches:

Oracle 11.2.0.4 with PSU 11.2.0.4.200414

oracle@hol:/u01/app/oracle/product/11.2.0.4/jdk/bin
$ ./java -version
java version "1.5.0_51"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_51-b10)
Java HotSpot(TM) 64-Bit Server VM (build 1.5.0_51-b10, mixed mode)

Oracle 12.2.0.1 with Apr 2020 RU: 12.2.0.1.200414

oracle@hol:/u01/app/oracle/product/12.2.0.1/jdk/bin
$ ./java -version
java version "1.8.0_241"
Java(TM) SE Runtime Environment (build 1.8.0_241-b07)
Java HotSpot(TM) 64-Bit Server VM (build 25.241-b07, mixed mode)

Oracle 19.7.0 with RU 19.7.0.0.200414

oracle@hol:/u01/app/oracle/product/19/jdk/bin
$ ./java -version
java version "1.8.0_241"
Java(TM) SE Runtime Environment (build 1.8.0_241-b07)
Java HotSpot(TM) 64-Bit Server VM (build 25.241-b07, mixed mode)

The important part here is: When you patch with an RU, no matter if it is Oracle 12.2.0.1, Oracle 18c or Oracle 19c, you will always get a recent JDK installed into the database home. By default this will be a 3 month year old JDK. The version 1_.8.0_241 is from January 2020.

This has been initiated in with the January 2020 RUs.

You can still patch to the match recent one. MOS Note: 2584628.1 – JDK and PERL Patches for Oracle Database Home and Grid Home offers you the download to it.

OPatch’es JDK?

All the April 2020 Opatch deployments deliver the same JDK. I’ve had to exchange all my OPatch versions before being able to apply the April 2020 patch bundles.

OPatch

oracle@hol:/u01/app/oracle/product/12.2.0.1/OPatch/jre/bin
$ ./java -version
java version "1.8.0_191"
Java(TM) SE Runtime Environment (build 1.8.0_191-b12)
Java HotSpot(TM) 64-Bit Server VM (build 25.191-b12, mixed mode)

This version 1.8.0_191 is from October 2019.

The OPatch owners confirmed that with the next opatch version being available most likely end of April 2020, you will get the same JDK as the database homes.

Summary

Since the January 2020 Release Updates, each RU (and I guess the RURs as well) contains a stable 3 month old JDK. This applies to Oracle 12.2.0.1, Oracle 18c and Oracle 19c. Of course, you can patch your older versions manually as well. And for instance, in the case of Oracle 11.2.0.4 you should do that as the current JDK is almost 5 years old and quite “insecure” I’d say. MOS Note: 2584628.1 – JDK and PERL Patches for Oracle Database Home and Grid Home is your best friend and gives you access to the recent JDK patch numbers and downloads.

Blake Lewis says:

April 22, 2020 at 21:51

We can only hope they will update the JDK in th EM Agent home, enabling reomving SHA1. Oracle Support is no help.

Reply
Emad Al-Mousa says:

April 23, 2020 at 04:42

Hi Mike,

Thanks for this very good article, and topic that is always being discussed lately with “security” teams as their scan tools will pick-up (report it as security finding) if the JDK update is for the last quarter CPU (based on an organization security policy and pro-active patching policies).

it will be great in the future if RU being applied will update the JDK with the latest CPU released build ! (instead of an old 3 months)

Also, in this page :https://www.oracle.com/technetwork/java/javase/8u241-relnotes-5813177.html

“It is not recommended that this JDK (version 8u241) be used after the next critical patch update scheduled for April 14, 2020. ”

so i believe Oracle should help in improving this.

Thanks,
Emad Al-Mousa

Reply
- Mike.Dietrich says:
  
  April 27, 2020 at 18:38
  
  I’ll check this – thanks,
  Mike
  
  Reply
  - Bill Barrow says:
    
    March 22, 2021 at 14:35
    
    Hi Mike – has anything progressed on this front? Have a similar security team scan tool which looks at what’s the latest java possible and then demands that of the DB homes, but the RU’s lag behind a quarter.
    
    Reply
    - Mike.Dietrich says:
      
      March 30, 2021 at 22:36
      
      Hi Bill,
      
      as far as I’m aware: no.
      
      Cheers,
      Mike
      
      Reply
Jan Schnackenberg says:

April 23, 2020 at 11:26

Thank you for this. I never really thought about the JDKs in the ORACLE_HOMEs.

Unfortunately: MOS Note 2584628.1 tells me, that this MOS ID is confidential.

Do you know the reason for this?

Regards,
Jan

Reply
- Mike.Dietrich says:
  
  April 27, 2020 at 18:40
  
  Jan,
  
  actually it is public. It may be that you caught a window where the owners updated it.
  Then the Note gets marked “internal”, the “ready to review” and then “published”.
  So you may have caught this time frame.
  
  Sorry for the inconvenience,
  Mike
  
  Reply
  - Jan Schnackenberg says:
    
    April 28, 2020 at 06:23
    
    Hi Mike,
    
    ok, that sounds like possibility. I’ll keep that in mind for future situations, where I encounter apparently “internal” MOS IDs.
    
    Thanks for the update.
    
    Reply
Rafal says:

April 29, 2020 at 09:47

Hi, regarding jdk in OPatch – do you have perhaps information whether it will be now updated regularly with each version of OPatch or this will be just one time update and for next one we will have to wait longer again ?

Reply
- Mike.Dietrich says:
  
  May 4, 2020 at 18:56
  
  It’s under discussion at the moment – lets hope that the solution will be an update with every opatch version.
  
  Cheers,
  Mike
  
  Reply
Matěj Tenkl says:

October 6, 2020 at 07:16

Hi Mike,

your blog post is about RU. But I am on Windows platform. I have analyzed zip files with 19.8.0.0.200714 Windows BP and OJVM BP and it seems that latest JDK is not included. Do you have some information why not? Or anyway will be JDK included in some future Windows BP?

Best regards

Matěj.

Reply
- Mike.Dietrich says:
  
  November 24, 2020 at 00:35
  
  Hi Matěj,
  
  sorry, your message must have slipped through.
  I guess (again) the Windows folks don’t follow the general principles 🙁
  
  Cheers,
  Mike
  
  Reply
Nelson says:

November 13, 2020 at 03:38

Does the JDK in the GI home also need to be updated? The MOS 2584628.1 states that “The jdk/perl patches can be applied to SIDB, GI & Client Oracle homes” but the patch doco doesn’t mention updating GI homes.

If patching JDK in GI home (I use Oracle Restart) do I need to run roothas.sh -prepatch first and -postpatch afterwards?

Cheers!

Reply
- Mike.Dietrich says:
  
  November 16, 2020 at 22:32
  
  Yes – we try to convince the responsible teams that everybody who has a JDK in the home needs to update it.
  Well … let’s see …
  
  Cheers,
  Mike
  
  Reply
Amit says:

November 23, 2020 at 11:21

Hi Mike,

How to update the JRE? I can’t find information on this anywhere.

Regards,
Amit

Reply
- Mike.Dietrich says:
  
  November 24, 2020 at 00:33
  
  See here please if that helps:
  https://www.oracle.com/java/technologies/javase/jre-update-scenarios.html
  
  Cheers,
  Mike
  
  Reply
Fabrizio says:

February 24, 2021 at 16:05

Ciao Mike,

I found some misleading notes into JDK patches README: eg. 32162391 for 19c, 32162724 for 18c, 32162748 for 12r2 states “Apply the latest RU before applying this patch.”
So to install the 32162748 one, I have to install first the 12.2.0.1.210119 RU, which already contains the JDK 🙂

Fortunately a colleague of mine pointed me to your post.. as someone says “Upgrade your database – now!”

regards,
Fabrizio

Reply
- Mike.Dietrich says:
  
  March 9, 2021 at 09:00
  
  Hi Fabrizio,
  
  thanks a lot – and your are absolutely correct.
  Let me send this to the people in charge … and it will be part of a blog post soon, too.
  
  Very good hint.
  
  Cheers,
  Mike
  
  Reply
Jeff says:

September 23, 2022 at 16:02

Thanks Mike for the great info. While the database RU updates the jdk to prior quarter, it would be nice if the cpu doc e.g. : Critical Patch Update (CPU) Program Jul 2022 Patch Availability Document (DB-only) (Doc ID 2867871.1) in addition to this comment:
“From Jan2020 onwards the Database and GI Update and Revision patches include the JDK fixes released in the prior cycle. For the most recent JDK fixes a separate patch is available (see below) and needs to be installed in addition to the Database and GI patches.”

would also state to go to this document for the final word on latest jdk for DB : JDK and PERL Patches for Oracle Database Home and Grid Home (Doc ID 2584628.1)

Really thank you for all the great info on patching… I’m fairly convinced that Oracle makes it this convoluted on purpose. I supposed it keeps the pay scales up, but it’s really unnecessarily complicated and convoluted. It’s so “Oracle”.

Reply
- Jeff says:
  
  September 23, 2022 at 16:07
  
  Guess I’ll correct myself. They do say “see below”. And indeed, below that they do show
  JDK8u341 Patch 34113634 and the source doc: Note 2584628.1, “JDK and PERL Patches for Oracle Database. So, while the RU16 has version 8_331, this is a slightly later version.
  
  Reply
  - Mike.Dietrich says:
    
    November 17, 2022 at 16:15
    
    Thanks Jeff!
    
    Cheers
    Mike
    
    Reply
kala says:

March 2, 2023 at 22:01

Hi Mike,
Is it possible to bundle latest JDK with the PSU .
Thanks

Reply
- Mike.Dietrich says:
  
  April 1, 2023 at 14:52
  
  Nope – this has to do with code freeze dates.
  When the code freeze for an RU happens, we can only include the latest available JDK – which is the one from weeks ago – but not the future one being available at the time the RU gets released.
  
  THanks,
  Mike
  
  Reply
James says:

May 15, 2023 at 08:47

Coming back late to this. Is there a case for a unified JDK.

Currently i have:
1 under grid home,
1 under oracle home,
1 under ahf,
1 under opatch
1 under oem agent

Its like whack a mole.

Also just did a quick test:
i routinely apply dbbp + jdk patch + any one offs even at 19 to both grid and db home.
last time out was 34773504 + 34777391
I would expect when i applied the jdk patch opatchauto to say “nothing to do patch already applied” but it happily [re]applies
when i rolled back the jdk patch i saw the $ORACLE_HOME/jdk/bin/java version drop from 361 to 351

Reply
- Mike.Dietrich says:
  
  May 15, 2023 at 11:15
  
  Hi James,
  
  we tried – but it seems to be a neverending story.
  At least with 23c there will be a change to GI as far as I am aware. But the teams seem not be willing to change the current delivery.
  
  For the overwriting issue, do you have an SR?
  I’d be interested in the logs.
  
  Cheers,
  Mike
  
  Reply
Thiru says:

September 4, 2023 at 18:41

Hello Mike,

Thanks for all your posts and updates.

One of our customer has Oracle 19c Grid Infra and I applied 19.18 in April (Jan 2023 CPU).

Customer is running Vulnerabilities Assessment and came out with this report for Java SE.

“Oracle Java SE Multiple Vulnerabilities (July 2023 CPU)”

Could you please tell me if I have to separately apply Patch 35336174: JDK BUNDLE PATCH 19.0.0.0.230718 in GI and DB Home?

If i apply 19.20 (July 2023 CPU) does it take care of updating JDK and JDK?

Thanks in advance.

Regards,
Thiru

Customer’s security recently came with vulnerablity assesement for “Oracle Java SE Multiple Vulnerabilities (April 2023 CPU)”.

Reply
- Mike.Dietrich says:
  
  September 11, 2023 at 20:19
  
  Hi Thiru,
  
  yes, this is the case. Since we deliver only n-1 as a version with an RU, vulnerability scripts often alert and ask to patch. This is more or less expected. But since only n-1 version is ready when we test the RU, and the “n” version is released at the same time, there is no option to include a newer JDK version unfortunately.
  
  Cheers,
  Mike
  
  Reply