Security Vulnerabilities in OpenJDK based Java runtimes

问题描述

Does the COMSOL software contain an OpenJDK™ based Java runtime and, if so, is it affected by known security vulnerabilities in OpenJDK? Can a newer OpenJDK based Java runtime version be used before the next COMSOL product update?

解决方法

Summary

The COMSOL software includes an OpenJDK based Java runtime that is used by COMSOL Multiphysics®, COMSOL Server™, Model Manager server, and other COMSOL software components.

Install the latest product updates for the COMSOL software to also update its bundled Java runtime. If needed, see below for more information about Java security vulnerabilities, the OpenJDK version bundled with each supported COMSOL version, and how to use a custom OpenJDK based Java runtime.

Security vulnerabilities

Security vulnerabilities affecting OpenJDK based Java runtimes are listed by the OpenJDK Vulnerability Group on theOpenJDK Vulnerability Advisoriespage.

Not all security vulnerabilities of OpenJDK apply to the COMSOL software, since the COMSOL software does not use all Java runtime functionality and may not have enabled the affected features.

Vulnerability assessments

The following notable vulnerabilities are fixed in the latest security updates of OpenJDK but not in the versions that are bundled with the latest supported COMSOL versions:

• CVE-2026-114820,CVE-2026-91403
  Assessment: Affected
  These vulnerabilities affect eMudhra certificates trusted by the Java runtime. To work around the vulnerabilities, either follow the general instructions underUsing a newer OpenJDK runtimebelow to use a custom Java runtime, or the specific instructions undereMudhra certificate security issueto patch an older Java runtime.

Using a newer OpenJDK runtime

A custom OpenJDK based Java runtime can be used if it meets the applicable system requirements:

• COMSOL 6.4:Java 21 version 21.0.7 or later
• COMSOL 6.3:Java 11 version 11.0.24 or later

The COMSOL software includes OpenJDK based Java runtimes from theEclipse Temurinproject. Newer Eclipse Temurin runtimes can be obtained from theEclipse Temurin releasespage. Select the applicable Java version and operating system, and selectJREas the package type. Other OpenJDK based runtimes meeting the applicable system requirements can also be used.

To use a custom Java runtime, launch the COMSOL installer, select a custom Java runtime instead of the built-in Java runtime, and specify the location of the custom runtime.

Note:Compatibility between the COMSOL software and new OpenJDK runtime versions cannot be guaranteed until they have been tested. If you use a custom Java runtime and encounter issues, please check whether the issue also occurs with the built-in runtime and contact COMSOL Support if needed.

eMudhra certificate security issue

In October 2026, it was disclosed that private keys corresponding to several eMudhra intermediate CA certificates had been compromised. Java security updates address this issue by distrusting the affected certificates and removing the relevant root certificates from the Java trust store. If updating to a custom Java runtime is not practical, the affected certificates can instead be removed from the trust store of the Java runtime used by the COMSOL software.

1. Find the path to the Javakeytool.

   • On Linux systems, the default path for COMSOL Multiphysics 6.4 is/usr/local/comsol64/multiphysics/java/glnxa64/jre/bin/keytool.
   • On macOS systems, the default path is/Applications/COMSOL64/Multiphysics/java/maci64/jre/bin/keytool.
   • On Windows systems, the default path isC:\Program Files\COMSOL\COMSOL64\Multiphysics\java\win64\jre\bin\keytool.exe.
   • Replaceglnxa64andmaci64withglnxarm64andmacarm64, respectively, on ARM64 based platforms.

2. Runkeytool -list -cacertsand locate the aliases of the affected root certificates listed in theEclipse Temurin eMudhra CA advisory. For the Java runtimes distributed with COMSOL, the aliases to remove are the following:

   • COMSOL 6.4:
     emSign ECC Root CA - G3:cn_emsign_ecc_root_ca__g3,o_emudhra_technologies_limited,ou_emsign_pki,c_in [jdk]
   • COMSOL 6.3:
     emSign ECC Root CA - G3:cn=emsign_ecc_root_ca_-_g3,o=emudhra_technologies_limited,ou=emsign_pki,c=in
     AAA Certificate Services:cn=aaa_certificate_services,o=comodo_ca_limited,l=salford,st=greater_manchester,c=gb

3. For each affected root certificate, runkeytool -delete -cacerts -alias "alias", replacing the quotedaliasvalue with the applicable alias listed above, or with the alias shown bykeytool -list -cacertsfor another Java runtime. You need to run the commands with permissions to write to the installation directory.

4. Enter the password of the Javacacertsfile which is by defaultchangeit.

Note:There might be other COMSOL software installed on the system. Take care to locate each COMSOL software installation and version that you use, and run thekeytoolfrom the Java runtime of that installation.

You can verify that an alias has been removed by runningkeytool -list -cacerts -alias "alias". If the entry has been successfully removed,keytoolreports that the alias does not exist.

After removing the certificates, restart the COMSOL software.

OpenJDK version

The following OpenJDK versions are included with the latest updates of the currently supported COMSOL versions:

• COMSOL 6.4 Update 3:OpenJDK 21.0.11
• COMSOL 6.3 Update 3:OpenJDK 11.0.24

In general, the OpenJDK version included with a particular COMSOL software installation can be determined by running thejavaexecutable included in the COMSOL installation with the-versionoption:

1. Find the path to thejavacommand that is included in the COMSOL software installation.
   • On Linux systems, the default path for COMSOL Multiphysics 6.4 is/usr/local/comsol64/multiphysics/java/glnxa64/jre/bin/java.
   • On macOS systems, the default path is/Applications/COMSOL64/Multiphysics/java/maci64/jre/bin/java.
   • On Windows systems, the default path isC:\Program Files\COMSOL\COMSOL64\Multiphysics\java\win64\jre\bin\java.exe.
   • Replaceglnxa64andmaci64withglnxarm64andmacarm64, respectively, on ARM64 based platforms.
2. Runjava -version. The output will include a version string such asopenjdk version "21.0.11".

按类别浏览

错误消息 (66)
导入 (7)
几何 (11)
物理场 (11)
求解器 (38)
安装 (42)
网格 (14)
通用 (39)
结构力学 (2)
流体动力学 (2)
后处理 (4)
导出 (1)
绘图 (1)
产品信息 (6)
多物理场 (1)
用户模型 (1)
电磁学 (1)