What is being done about Java 8 and Java upgrades in general?

Wowza Streaming Engine
1

To: Rose Power – Wowza Community Manager

What is being done about Java 8 and Java upgrades in general?

We need to be able to apply timely security updates. The version of Java being used by Wowza is no longer supported.

This document suggests newer versions can be used. Can we go to the latest version(s) of Java that are still seeing security updates.

https://www.wowza.com/docs/manually-install-and-troubleshoot-java-on-wowza-streaming-engine

“If you can’t or don’t want to use the version of Java that installs with Wowza Streaming Engine and you don’t use Wowza Streaming Engine Manager, you can install and use a server edition of Java 8 Update 91 (8u91) or later.

2

Hi @Marc Thoma,

Wowza is working on including a newer version of Java in an upcoming installer of Wowza Streaming Engine. That is the info we have to share at the moment.

In my tests on a local test machine, I can say that Wowza Engine works with the latest version of Oracle’s Java 8 and also with the latest version of OpenJDK’s Java.

If you have a specific security concern we would happy to address and assist if you open a support ticket here: https://www.wowza.com/support/open-ticket

Regards,
Alex Chepurnoy

Wowza Support

3

Thanks Alex for replying. Is there a roadmap and timeline for the next version as to when we can expect it? Can you comment on which specific version of Java will be included?

So what are we supposed to do if we need the Wowza Streaming Engine Manager? Or from your testing did the Manager work with Java 8.

And what versions specifically did you test with? Thanks.

4

I tested what was available at the moment. This is what I have installed now.

Java Version 1.8.0_222

Java VM Version 25.222-b10

Java Name OpenJDK 64-Bit Server VM
Regarding your question of when the new version is coming out and what version it will be, I don’t have any solid info to share at this time.
If you have specific workflows that are suffering because of Java 8, please do let us know by creating the support ticket.

5

We are in the process of project planning and need to know a definitive date when we can expect a new version of WSE that includes a fully supported version of Java that has no known vulnerabilities.

We cannot run vulnerable systems.

So when are you planning to release a version of WSE that includes a fully supported version of Java that has no known vulnerabilities?

6

So seeing as I can’t get an answer regarding the timeline of when we can expect a version of WSE that includes a fully supported version of Java that has no known vulnerabilities:

What can we do to reduce the risks associated with running JAVA with known security vulnerabilities?

7

Looking into what I can provide for you @Marc Thoma. Post again here in just a bit.

8

Hey @Marc Thoma, sorry for the wait on this. We are releasing our next version of Engine that will ship with Java 9 in the 2nd week of November at the latest. Still completing some final tests.

Having said that, you CAN run Engine with a newer version of Java and we recommend Java 11. You can configure that to to work the current Engine 4.7.7.

If you need any help at all doing this right away, please submit a support ticket to make sure this goes smoothly for you. We are happy to help make sure you have no vulnerabilities.

https://www.wowza.com/support/open-ticket

9

Thanks Rose, that is good news regarding the date of release of the next version.

10

The latest version of Streaming Engine is 4.7.8 and it does support Java 9. There are a few very important details involved if you’d like to upgrade and we advise you read this first:

https://www.wowza.com/docs/wowza-streaming-engine-4-7-8-release-notes

11

Thank you @Rose Power-Wowza Community Manager. We will test it out.