Running Oracle Forms MD5-Signed Jar Files Warning

Beginning April 18, 2017, Oracle now considers any jar files signed with MD5 to be unsigned due to the security vulnerabilities with MD5 signatures. Starting with Java Runtime Environment (JRE) 1.8.0_131 (Java 8 Update 131), when it is used for running Oracle Forms (all versions), any jar files signed with MD5 will be blocked:

More information from Oracle on this may be found at https://blogs.oracle.com/java-platform-group/oracle-jre-will-no-longer-trust-md5-signed-code-by-default.

For any of your custom jar files, they will need to be re-signed without MD5 (MD5withRSA). It is recommended to use SHA-256 (or SHA-2).

As for the jar files which come installed with Oracle Forms (frmall.jar, frmwebutil.jar, etc.), if you are using Forms 12c (12.2.1.0.0 or higher), you will have no problem running the application because the jar files are not signed with MD5. However, if you are running Oracle Forms 11gR2 or older (including 11.1.2.2.0), you will get this warning upon launching your application which will result in the application not launching at all. To fix this problem, you will have the following options to choose from:

• Upgrade to Oracle Forms 12c
• Apply Patch 19933795 to your Oracle Forms environment (see steps below to apply the patch)
  • NOTE: This patch is only available for Oracle Forms versions 11.1.1.7.0 and 11.1.2.2.0. If you are using a version older than these, you will need to upgrade to either these versions or to 12c.
• Run a JRE older than 8u131 (not recommended due to increased security risks)
• Add your Forms site to the Exception Site List in each end user’s Java Control Panel (not recommended due to the fact that this will need to be done for every user’s PC)

If you decide to apply Patch 19933795 to your Forms environment after downloading it from My Oracle Support, you will need to run these steps:

1. Shut down everything in your Oracle Forms environment (all WebLogic servers, Node Manager, and anything running within OPMNCTL).
2. Extract the zip file containing the patch.
3. Go into the extracted folder and then inside the 19933795 folder.
4. Open up Command Prompt as an administrator and change the directory to the 19933795 folder.
5. Set ORACLE_HOME to your Forms Oracle Home.
   • Example: set ORACLE_HOME=C:\Oracle\Middleware\Oracle_FRHome1
6. Append the PATH to include the OPatch folder inside %MW_HOME%\oracle_common.
   • Example: set PATH=%PATH%;C:\Oracle\Middleware\oracle_common\OPatch
7. Run opatch version to make sure that OPatch is working.
8. Run opatch apply to apply the patch. Making sure that the Middleware home is the correct home for your Forms environment, type in y when it asks if the local system is ready for patching.
9. When the patch is applied successfully, start up everything in the WebLogic environment.

After running the steps above, Oracle Forms should run normally.

NOTE: If you are using PITSS.CON for Forms 12c, although none of the PITSS.CON jar files will be blocked (they are not signed with MD5), the bundled frmwebutil.jar will still be using the MD5-signed jar file. Please contact PITSS Support at us.support@pitss.com, and PITSS can provide you an updated jar file which is not signed with MD5 as a part of your maintenance agreement.

The post Running Oracle Forms MD5-Signed Jar Files Warning appeared first on PITSS US - Oracle Forms Upgrade, Forms to ADF, Forms to APEX, Migration.