DX NetOps

 View Only
  • 1.  Spectrum again/still shipping with outdate JRE

    Posted Jan 23, 2023 05:17 AM
    Hello Broadcom,

    great to see another release of the DX NetOps software suite.
    Quickly checking the release notes for Spectrum (System Requirements for Linux), I found the included/required AdoptOpenJDK JRE to be 8u302. That release is from July 2021 (Archive | Adoptium), means approaching an age of 2 years. Shipping old software components like that has been a discussion for years and isn't really acceptable. Please incoporate more recent (up-to-date) JRE versions with the product on a regular basis to avoid potential vulnerability exposure.

    thanks,
    Raphael


  • 2.  RE: Spectrum again/still shipping with outdate JRE

    Broadcom Employee
    Posted Jan 23, 2023 11:50 AM
    It appears latest Spectrum 22.2.5 is shipping with AdoptOpenJDK 8u352 (Oct 22, 2022).

    And the next available release is 8u362, which just came out Jan 20th, 2022.  That'll probably be looked at for upcoming release.

    Docs could probably be updated to reflect when Java is upgraded.


  • 3.  RE: Spectrum again/still shipping with outdate JRE

    Posted Jan 23, 2023 12:17 PM

    Hi @Jeffrey Pinard,

    thanks for following up and sorry for me not verifying docs vs. reality first.
    I've raised a doc update request.

    regards,
    Raphael​