12 thoughts

  1. Anybody else getting this error on the cfwindow tag and some cf admin operations after applying this hotfix?
    Could not initialize class coldfusion.security.ESAPIUtils

  2. It’s a little scary. We tried to upgrade to the first CF9 patch when it rolled out and it didn’t play nicely with SeeFusion and killed all of our datasources. There doesn’t seem to be much testing of the hotfixes or patches. I am afraid to do anything to our CF9 boxes now.

  3. Hi Ben,
    Just fyi.. I just realized this Hotfix isn’t mentioned on CF’s home page. (www.coldfusion.com)
    The previous one (August 10, 2010) is, but the "News" section hasn’t been updated to list the current one (February 8, 2011).
    Thanks,
    -Aaron Neff

  4. Yeah we had to roll it back. So now everybody knows about the exploit but we have no way of patching it without breaking something else 🙁

  5. If you ‘re getting the "ClassNotFoundException: coldfusion.security.ESAPIUtils" error, it’s because you pulled the same boneheaded move that I did, and tried to apply the CHF to 9.0, when you first need to update to 9.0.1

  6. @Shannon: I am getting that error, but don’t think it is because we are boneheads. The hotfix does say cumulative… obviously not.
    Thanks for the post, I would have banged my head against that wall for more than necessary 😉

  7. I’m getting this same error, and this is the stacktrace:
    Object Instantiation Exception.
    Class not found: coldfusion.security.ESAPIUtils
    The error occurred in C:workColdFusioncf9_u1_final_hotfixcfusionwwwrootCFIDEadministratorApplication.cfm: line 69
    Called from C:workColdFusioncf9_u1_final_hotfixcfusionwwwrootCFIDEadministratorApplication.cfm: line 4
    Called from C:workColdFusioncf9_u1_final_hotfixcfusionwwwrootCFIDEadministratorApplication.cfm: line 1
    Called from C:workColdFusioncf9_u1_final_hotfixcfusionwwwrootCFIDEadministratorApplication.cfm: line 69
    Called from C:workColdFusioncf9_u1_final_hotfixcfusionwwwrootCFIDEadministratorApplication.cfm: line 4
    Called from C:workColdFusioncf9_u1_final_hotfixcfusionwwwrootCFIDEadministratorApplication.cfm: line 1
    -1 : Unable to display error’s location in a CFML template.
    Note, I’m on a Mac and (obviously) I don’t have a C: drive. Does this patch have hard coded values in it for the dev who authored it? WTF?

Leave a Reply to Nolan Dubeau Cancel reply