July 18, 2023
The full version string for this update release is 20.0.2+9 (where "+" means "build"). The version number is 20.0.2.
JDK 20.0.2 contains IANA time zone data 2023c which contains the following changes:
For more information, refer to Timezone Data Versions in the JRE Software.
The security baselines for the Java Runtime Environment (JRE) at the time of the release of JDK 20.0.2 are specified in the following table:
|JRE Family Version||JRE Security Baseline (Full Version String)|
Oracle recommends that the JDK is updated with each Critical Patch Update. In order to determine if a release is the latest, the Security Baseline page can be used to determine which is the latest version for each release family.
Critical patch updates, which contain security vulnerability fixes, are announced one year in advance on Critical Patch Updates, Security Alerts and Bulletins. It is not recommended that this JDK (version 20.0.2) be used after the next critical patch update scheduled for October 17, 2023.
The China National Standard body (CESI) has recently published GB18030-2022, which is an updated version of the GB18030 standard and brings GB18030 in sync with Unicode version 11.0. The
Charset implementation for this new standard has now replaced the prior
2000 standard. However, this new standard has some incompatible changes from the prior implementation. For those who need to use the old mappings, a new system property,
jdk.charset.GB18030, is introduced. By setting its value to
2000, the previous JDK releases' mappings for the
GB18030 Charset are used, which are based on the
Installing into the same, shared
jdk-(family) directory is the default behavior for the JDK starting with the July 2023 CPU. It could lead to
FilesInUse issues if JDK files are locked by the "System User". We recommend shutting down any apps using the JDK as the "System User" before upgrading.
/usr/java/defaultSymlink on Linux Restored (JDK-8306690)
A regression where the
/usr/java/default symlink is not created by RPM installers on Linux platforms has been fixed. Installers will create the
/usr/java/default symlink if it doesn't exist, targeting the
The JDK RPM installer will remove incorrectly constructed entries of "java" and "javac" groups registered by older Oracle JDK RPM installers from the alternatives before registering new "java" and "javac" entries.
An incorrectly constructed entry of the "java" group contains commands that are supposed to belong to the "javac" group.
An incorrectly constructed entry of the "javac" group contains commands that are supposed to belong to the "java" group.
All incorrectly constructed entries belonging to Oracle JDK RPM packages will be removed from the alternatives to avoid corruption of the alternatives internal data.
The removal has a potential side effect for users who have installed multiple JDK versions that are not updated to the latest release. Commands from a removed "java" or "javac" group are now unavailable for system Java switch, which potentially changes the current system Java without a warning. For example, if there is an out-of-date JDK RPM from an 11+ release, say 11.0.17, with an incorrectly constructed single "java" group installed and 8u381 RPM with this patch is installed, it will remove an entry from the "java" group belonging to the 11.0.17 RPM and thus will switch the current system Java from 11.0.17 to 8u381. The side effect will only happen when you install a lower JDK family with the fix, such as 8u381, and there is an out-of-date JDK from a higher family, such as 11.0.17, installed on the system. In that case, 8u381 will replace the older 11.0.17 as the latest. The remedy for the user is to install the latest JDK 11.
The following root certificate has been added to the cacerts truststore:
+ TWCA + twcaglobalrootca DN: CN=TWCA Global Root CA, OU=Root CA, O=TAIWAN-CA, C=TW
The following root certificates have been added to the cacerts truststore:
+ Google Trust Services LLC + gtsrootcar1 DN: CN=GTS Root R1, O=Google Trust Services LLC, C=US + Google Trust Services LLC + gtsrootcar2 DN: CN=GTS Root R2, O=Google Trust Services LLC, C=US + Google Trust Services LLC + gtsrootecccar3 DN: CN=GTS Root R3, O=Google Trust Services LLC, C=US + Google Trust Services LLC + gtsrootecccar4 DN: CN=GTS Root R4, O=Google Trust Services LLC, C=US
The following root certificates have been added to the cacerts truststore:
+ Microsoft Corporation + microsoftecc2017 DN: CN=Microsoft ECC Root Certificate Authority 2017, O=Microsoft Corporation, C=US + Microsoft Corporation + microsoftrsa2017 DN: CN=Microsoft RSA Root Certificate Authority 2017, O=Microsoft Corporation, C=US
Starting with the July 2023 CPU, on operating systems where ASLR (Address Space Layout Randomization) is enabled, the CDS archive will be placed at a random address picked by the operating system.
This change may have a minor performance impact: (a) Start-up time may increase because the JVM needs to patch pointers inside the CDS archive. (b) Memory usage may increase because the memory used by the CDS archive is no longer shareable across processes. We expect the impact to be small because such increases should be only a small fraction of the overall application usage.
In the unlikely event that you must disable ASLR for CDS, you can use the JVM flags
-XX:+UnlockDiagnosticVMOptions -XX:ArchiveRelocationMode=0. The usage of such flags is not recommended.
A new system property,
jdk.jar.maxSignatureFileSize, has been added to allow applications to control the maximum size of signature files in a signed JAR. The value of the system property is the desired size in bytes. The default value is 8000000 bytes.
java.util.zip.ZipFile has been updated to provide additional validation of ZIP64 extra fields when opening a ZIP file. This validation may be disabled by setting the system property
This release also contains fixes for security vulnerabilities described in the Oracle Critical Patch Update.➜ Issues fixed in 20.0.2:
|1||JDK-8298887||client-libs||On the latest macOS+XCode the Robot API may report wrong colors|
|2||JDK-8301998||client-libs/2d||Update HarfBuzz to 7.0.1|
|3||JDK-8305352||client-libs/java.awt||updateIconImages may lead to deadlock after JDK-8276849|
|4||JDK-8227257||client-libs/javax.swing||javax/swing/JFileChooser/4847375/bug4847375.java fails with AssertionError|
|5||JDK-8301119||core-libs/java.nio.charsets||Support for GB18030-2022|
|6||JDK-8307466||core-libs/java.time||java.time.Instant calculation bug in until and between methods|
|7||JDK-8303440||core-libs/java.util:i18n||The "ZonedDateTime.parse" may not accept the "UTC+XX" zone id|
|8||JDK-8303937||core-svc/tools||Corrupted heap dumps due to missing retries for os::write()|
|9||JDK-8299179||hotspot/compiler||ArrayFill with store on backedge needs to reduce length by 1|
|10||JDK-8302976||hotspot/compiler||C2 Intrinsification of Float.floatToFloat16 and Float.float16ToFloat Yields Different Result than the Interpreter|
|11||JDK-8302595||hotspot/compiler||use-after-free related to GraphKit::clone_map|
|12||JDK-8299959||hotspot/compiler||C2: CmpU::Value must filter overflow computation against local sub computation|
|13||JDK-8303564||hotspot/compiler||C2: "Bad graph detected in build_loop_late" after a CMove is wrongly split thru phi|
|14||JDK-8303508||hotspot/compiler||Vector.lane() gets wrong value on x86|
|15||JDK-8299570||hotspot/compiler||[JVMCI] Insufficient error handling when CodeBuffer is exhausted|
|16||JDK-8300079||hotspot/compiler||SIGSEGV in LibraryCallKit::inline_string_copy due to constant NULL src argument|
|17||JDK-8299259||hotspot/compiler||C2: Div/Mod nodes without zero check could be split through iv phi of loop resulting in SIGFPE|
|18||JDK-8296389||hotspot/compiler||C2: PhaseCFG::convert_NeverBranch_to_Goto must handle both orders of successors|
|19||JDK-8296318||hotspot/compiler||use-def assert: special case undetected loops nested in infinite loops|
|20||JDK-8296412||hotspot/compiler||Special case infinite loops with unmerged backedges in IdealLoopTree::check_safepts|
|21||JDK-8297730||hotspot/compiler||C2: Arraycopy intrinsic throws incorrect exception|
|22||JDK-8301491||hotspot/compiler||C2: java.lang.StringUTF16::indexOfChar intrinsic called with negative character argument|
|23||JDK-8201516||hotspot/compiler||DebugNonSafepoints generates incorrect information|
|24||JDK-8289748||hotspot/compiler||C2 compiled code crashes with SIGFPE with -XX:+StressLCM and -XX:+StressGCM|
|25||JDK-8303511||hotspot/compiler||C2: assert(get_ctrl(n) == cle_out) during unrolling|
|26||JDK-8307346||hotspot/gc||Add missing gc+phases logging for ObjectCount(AfterGC) JFR event collection code|
|27||JDK-8302191||hotspot/runtime||Performance degradation for float/double modulo on Linux|
|28||JDK-8305994||hotspot/runtime||Guarantee eventual async monitor deflation|
|29||JDK-8306825||hotspot/runtime||Monitor deflation might be accidentally disabled by zero intervals|
|30||JDK-8304671||tools/javac||javac regression: Compilation with --release 8 fails on underscore in enum identifiers|
|31||JDK-8304878||tools/javadoc(tool)||ConcurrentModificationException in javadoc tool|
|32||JDK-8297587||tools/jshell||Upgrade JLine to 3.22.0|
|33||JDK-8301269||xml/jaxp||Update Commons BCEL to Version 6.7.0|