CIB seven 2.0.14 EE hotfix - Release Notes

Release Date: November 4, 2026

Docker Rebuilt Docker images of CIB seven 2.0.14 EE with updated operating system and Java runtime packages. The CIB seven distribution inside the images is unchanged, and there is no new ZIP distribution. The images are tagged with a -hotfix suffix: 2.0.14-ee-hotfix, tomcat-2.0.14-ee-hotfix, run-2.0.14-ee-hotfix and wildfly-2.0.14-ee-hotfix, plus the Java 21 variants java21-tomcat-2.0.14-ee-hotfix, java21-run-2.0.14-ee-hotfix and java21-wildfly-2.0.14-ee-hotfix. The 2.0.14-ee images are not changed
Security 3 Critical CVEs resolved by the updated Java runtime, openssl and ca-certificates packages, including CVE-2026-91403 (compromised eMudhra intermediate CA certificates)

Update openssl (libcrypto3, libssl3) from 3.5.8-r0 to 3.5.9-r0 (Alpine base image)
Update the Java runtime to 17.0.21.0.3 (openjdk17-jre-headless, Java 17 images) and 21.0.13.0.3 (openjdk21-jre-headless, Java 21 images) (Alpine base image), which blocks the compromised eMudhra intermediate CA certificates
Update ca-certificates to 20261020 (Alpine base image), which no longer trusts emSign ECC Root CA - G3

CVE-2026-91403 - eMudhra generated weak private keys for 8 intermediate CAs, so TLS certificates that chain to them can be forged. This exposes outbound TLS connections from the container that use the default Java truststore, e.g. the HTTP connector, OIDC/JWKS or mail. Affects the Java truststore (openjdk, ca-certificates). - CVSS 9.1.
CVE-2026-46470 - Critical vulnerability in a package of the Docker images, resolved by the package updates above.
CVE-2026-114820 - Critical vulnerability in a package of the Docker images, resolved by the package updates above.