Oracle Java changes regarding security and licensing

Update October 2021

Oracle once again changed their licensing terms and now JDK17 (the latest Long Term Support LTS) release can be used for free «for your own personal use or internal business operations». But as usual there is a catch. You will only keep receiving free updates for JDK17 until one year after the next LTS version is released. JDK21 will be released in September 2023 which means that updates for JDK17 will stop by September 2024 unless you have a paid subscription. So if you want to keep using Oracle’s JDK for free, you will be forced to migrate to a new version every two years.

Our recommendation remains to use OpenJDK based alternatives if at all possible and to upgrade to JDK17 if you still have installations that absolutely require Oracle JDK. Please note that you will have to upgrade every two years to keep receiving updates free of charge.

 

Note: Oracle’s Java now requires a license and you are liable to pay.

Oracle Java licensing changes April 2019

Oracle Corp. has changed its licensing conditions for Java so that future Oracle Java versions including Java 8 and newer require a license with costs for commercial use (also includes academic research). ETH Zurich as a university is also affected.

Existing Oracle Java 8 installations can still be used in the current version free of charge, but free security updates will cease by April 16th 2019. Oracle Java 8 will automatically change to a commercial license with costs as soon as you install an update after this date. Use of the software will become illegal with the update installation since ETH Zurich does not have a general licensing contract with Oracle for Java and since refraining from installing the update is not allowed for security reasons the only course of action that remains is to uninstall Oracle Java.

Who is affected?

If you have Java software by Oracle installed on a client or server or use software that contains Oracle’s Java as an integral part and does not come with the necessary Oracle license (PTC software is an example) then you will have to take action.

Not affected are users who, for whatever reason, already have a commercial Oracle Java license (check the coverage) or use Java by a different vendor (IBM, RedHat, Amazon, Azul Systems, jClarity, BellSoft etc.). Linux distributions usually come with an OpenJDK version and are only affected if Oracle Java was installed.

What to do?

If affected, we recommend you take urgent action as follows:

  •  
  • – Uninstall Oracle Java (any version) from client machines and servers (including virtual machines) as soon as possible.
  • – Install an alternative product (based on OpenJDK, see link below for further information) and test the functionality of your software. Incompatibilities can occur.
  • – You will have to pay for a license if replacing Oracle Java with an alternative product is not possible.

 

Failing to take action can expose you and ETH Zurich to legal and security risks.

Report the licenses you require

Please report the number of users to be licensed to us (email: itshop@ethz.ch) if you absolutely have to rely on Oracle Java. The charge will be at least Fr. 30.— per user and year. Please note that running a server application that uses Oracle Java and is accessible to a large number of users can be very costly.

Central licensing solution in the works

We are working on finding a solution with Oracle as soon as possible that will allow us to offer Oracle Java licenses in IT Shop. Please do not contact Oracle directly, get in touch with us for questions.

FAQ

– Is JRE also affected or do the licensing changes only apply the the JDK?

Yes, unfortunately Oracle’s JRE (Java Runtime Environment) does also fall under the new licensing rules. All Java software by Oracle released under the «Oracle Binary Code License» is affected. Sofware released by Oracle under the «GNU General Public License version 2» like OpenJDK is still free to use but will require you to update to a new version every six months. 

Links