ARIS EXPESS - JAVA vulnerabilities

Hi Aleksandra,

I am not an ARIS employee, but an independent consultant using ARIS Express for some training sessions. I fear that there will be no more official updates of ARIS Express as SAG ARIS tries to force users to use their cloud offerings. Unfortunately, there hasn't even been an official response here yet.

But what you can do, you can replace the bundled JRE version. I have successfully tested replacing the JRE bundled with ARIS Express 2.4j (2.4j is the latest official Windows version, the documented version 2.4d on the website is still a typo). This is of course not an official ARIS recommendation and comes without any guarantee.

My starting point was:

OpenJDK Client VM (Zulu 8.66.0.16-SA-win32) (build 25.352-b08, mixed mode)

So ARIS Express 2.4j was using OpenJDK 8u352, 32-bit.

What I did was quite simple:

1. Closed ARIS Express.
2. Renamed the existing ARIS Express\client\jre folder as a backup.
3. Downloaded a current Azul Zulu OpenJDK 8 JRE for Windows x86/32-bit 8u504 (https://cdn.azul.com/zulu/bin/zulu8.96.0.205-ca-jre8.0.504-win_i686.zip)
4. Extracted it and replaced ARIS Express\client\jre with the new version
5. Checked that ARIS Express\client\jre\bin\java.exe existed.
6. Started ARIS Express normally.

I tested this and ARIS Express 2.4j started and worked without any problems in my tests. You see the actual version 504:

I deliberately stayed with Java 8 and 32-bit, so only the JRE patch level was changed. Keeping the original jre folder as a backup also makes it very easy to revert if something does not work.

Again, this is only my own successful test, not an officially supported or guaranteed configuration.

Regards

Klemens