#AZUL OPENJDK LICENSE UPDATE#
#AZUL OPENJDK LICENSE CODE#
#AZUL OPENJDK LICENSE LICENSE#

#AZUL OPENJDK LICENSE LICENSE#

Note that there are multiple reasons why a CVE may appear to be present in a docker image, as explained here. Given the fact that the OpenJDK TCK license doesnt allow testing on behalf. I would assume any OpenJDK is safe to redistribute with your application. This is in addition to the Classpath exception to the GPL that applies mostly to the runtime library code.

#AZUL OPENJDK LICENSE CODE#

Redistribution is permitted as long as it is not for a fee. Hotspot and most of the JVM code (mostly C/C++ native code) in the OpenJDK is released under the GPL 2.0 with Assembly Exception and not a 'bare' GPL. This license for the Oracle JDK, subject to the conditions, permits free use for all users, even commercial and production use. If a new base image has not yet been made generally available by a base docker image supplier, please contact that supplier to request that the fix be addressed in a new base docker image distribution. The new license is the 'Oracle No-Fee Terms and Conditions' (NFTC) license. Alpine-based docker images are available from the Docker Hub Alpine Linux page.ĭocker Hub automatically rebuilds Docker images when a new base image is made available, but the Corretto team does not make changes to our Dockerfiles to pull in one-off package updates.

AWS only supplies base docker images for Amazon Linux, which are available from the Docker Hub Amazon Linux 2 page and the Amazon Linux 2 ECR Public Gallery. If no updated package is available, please treat this as a potential security issue and follow the or email AWS security directly at is the responsibility of the base docker image supplier to provide timely security updates to images and packages. Licenses allow Azul Zulu Prime JVM instance launches up to the end of the day they are due to expire within the local timezone specified in the. Licensed under the terms of the GPLv2 open source license with the ClassPath Exception, Zulu is an OpenJDK-based JVM for Windows Server on the Windows Azure.

To use any other file location, you must add -XX:ZingLicenseFile to your Azul Zulu Prime JVM instance launch command.

#AZUL OPENJDK LICENSE UPDATE#

run 'yum update -y -security' for AmazonLinux or 'apk -U upgrade' for Alpine Linux in your Dockerfiles or systems to resolve the issue immediately. Copy the license file to your target host’s /etc/zing/ directory. If no updated image is available, run the appropriate command to update packages for the platform, e.g. Updated Corretto-Docker images are available at this site. If a security scanner reports that a Corretto-Docker image includes a CVE, the first recommended action is to seek an updated version of this image. Java SE 17 If you want free updates (including security) of Java SE 17, use an OpenJDK distribution that passes the TCK, such as Amazon, Azul, BellSoft. Q: Why does security scanner show that a docker image has a CVE? Newer versions of Oracles Java builds are under a new commercial license and you may not be allowed to use those versions.

Azul openjdk license