Java SE 7 Advanced

Beginning with this release, the default behavior has been changed to no longer use a direct connection when the first proxy connection attempt fails. Oracle JDK 8u221 using the legacy encoder returns encoded data in a format without
or
. Oracle JDK 8u231 has upgraded the Apache Santuario libraries to v2.1.3.

A new system property, “jdk.tls.ephemeralDHKeySize”, is defined to customize the ephemeral DH key sizes. This can be set to “legacy” if the older JDK behavior (DH keysize of 768 bits) is desired. The following sections summarize changes made in all Java SE 7u85 BPR releases.

Java SE 7 Archive Downloads

See the notes in the java.security file shipping with this release for more information. The following sections summarize changes made in all Java SE 7u161 BPR releases. With one exception, keytool will always print a warning if the certificate, certificate request, or CRL it is parsing, verifying, or generating is using a weak algorithm or key. The following sections summarize changes made in all Java SE 7u171 BPR releases. The following sections summarize changes made in all Java SE 7u181 BPR releases.

The behavior can be controlled via the new crypto.policy Security property found in the /lib/java.security file. The generateSecret(String) method has been mostly disabled in the javax.crypto.KeyAgreement java 7 certifications services of the SunJCE and SunPKCS11 providers. Invoking this method for these providers will result in a NoSuchAlgorithmException for most algorithm string arguments.

Enterprise Java (Cloud & OnPrem Technologies)

For a more complete list of the bug fixes included in this release, see the JDK 7u181 Bug Fixes page. For a more complete list of the bug fixes included in this release, see the JDK 7u191 Bug Fixes page. For a more complete list of the bug fixes included in this release, see the JDK 7u201 Bug Fixes page.

• If a user’s version of Java is below the security baseline, it redirects the user to java.com to get an updated JRE.
• MD5 must not be used for digital signatures where collision resistance is required.
• Serialization Filtering introduces a new mechanism which allows incoming streams of object-serialization data to be filtered in order to improve both security and robustness.
• For systems unable to reach the Oracle Servers, a secondary mechanism expires this JRE (version 7u85) on November 20, 2015.