The shipped default java.security was updated in u265, we need to update our puppetised copy. I've trimmed the change to remove the changes we've made ourselves (there were no changes to the jdk.certpath settings):
--- /etc/java-8-openjdk/security/java.security 2020-08-19 15:33:15.703624428 +0000 +++ /etc/java-8-openjdk/security/java.security.dpkg-new 2020-08-12 08:17:29.000000000 +0000 @@ -225,7 +224,10 @@ jdk.nashorn.internal.,\ jdk.nashorn.tools.,\ jdk.xml.internal.,\ - com.sun.activation.registries. + com.sun.activation.registries.,\ + jdk.jfr.events.,\ + jdk.jfr.internal.,\ + jdk.management.jfr.internal. # # List of comma-separated packages that start with or equal this string @@ -275,7 +277,10 @@ jdk.nashorn.internal.,\ jdk.nashorn.tools.,\ jdk.xml.internal.,\ - com.sun.activation.registries. + com.sun.activation.registries.,\ + jdk.jfr.events.,\ + jdk.jfr.internal.,\ + jdk.management.jfr.internal. # # Determines whether this properties file can be appended to @@ -441,7 +446,7 @@ # # Disable Kerberos cross-realm referrals. Value may be overwritten with a # System property (-Dsun.security.krb5.disableReferrals). -sun.security.krb5.disableReferrals=true +sun.security.krb5.disableReferrals=false # Maximum number of AS or TGS referrals to avoid infinite loops. Value may # be overwritten with a System property (-Dsun.security.krb5.maxReferrals).