Debian Package Tracker

general

source: nss (main)
version: 2:3.45-1
maintainer: Maintainers of Mozilla-related packages (DMD)
uploaders: Mike Hommey [DMD]
arch: any
std-ver: 4.1.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2:3.26-1+debu8u3
o-o-sec: 2:3.26-1+debu8u5
oldstable: 2:3.26.2-1.1+deb9u1
old-sec: 2:3.26.2-1.1+deb9u1
stable: 2:3.42.1-1
testing: 2:3.45-1
unstable: 2:3.45-1

versioned links

2:3.26-1+debu8u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:3.26-1+debu8u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:3.26.2-1.1+deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:3.42.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:3.45-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libnss3 (9 bugs: 0, 9, 0, 0)
libnss3-dev (4 bugs: 0, 2, 2, 0)
libnss3-tools (1 bugs: 0, 1, 0, 0)

action needed

Multiarch hinter reports 1 issue(s) high

There are issues with the multiarch metadata for this package.

libnss3-dev conflicts on /usr/bin/nss-config on any two of amd64, arm64, armel, armhf, and 6 more

Created: 2016-09-14 Last update: 2019-08-17 14:07

6 security issues in stretch high

There are 6 open security issues in stretch.

5 important issues:

CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
CVE-2018-18508:
CVE-2019-11719: When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
CVE-2018-12404: A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.
CVE-2019-11727: A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.

1 issue skipped by the security teams:

CVE-2018-12384: When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.

Please fix them.

Created: 2018-09-04 Last update: 2019-07-28 08:39

3 security issues in buster high

There are 3 open security issues in buster.

3 important issues:

CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
CVE-2019-11719: When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
CVE-2019-11727: A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.

Please fix them.

Created: 2019-07-10 Last update: 2019-07-28 08:39

7 bugs tagged patch in the BTS normal

The BTS contains patches fixing 7 bugs, consider including or untagging them.

Created: 2019-04-01 Last update: 2019-08-17 14:15

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2018-09-11 Last update: 2019-08-17 13:22

3 ignored security issues in jessie low

There are 3 open security issues in jessie.

3 issues skipped by the security teams:

CVE-2018-12384: When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.
CVE-2016-9074: An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
CVE-2019-11727: A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.

Please fix them.

Created: 2016-11-16 Last update: 2019-07-28 08:39

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2017-10-26 Last update: 2017-10-26 07:22

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.4.0 instead of 4.1.4).

Created: 2018-08-20 Last update: 2019-07-10 08:13

news

[rss feed]

[2019-07-20] Accepted nss 2:3.26-1+debu8u5 (source amd64) into oldoldstable (Roberto C. Sanchez)
[2019-07-16] nss 2:3.45-1 MIGRATED to testing (Debian testing watch)
[2019-07-09] Accepted nss 2:3.45-1 (source) into unstable (Mike Hommey)
[2019-06-04] Accepted nss 2:3.44+really3.42.1-2 (source) into unstable (Mike Hommey)
[2019-06-02] Accepted nss 2:3.44.0-1 (source) into experimental (Mike Hommey)
[2019-06-02] Accepted nss 2:3.44+really3.42.1-1 (source) into unstable (Mike Hommey)
[2019-06-01] Accepted nss 2:3.44-1 (source) into unstable (Mike Hommey)
[2019-03-05] Accepted nss 2:3.26-1+debu8u4 (source amd64) into oldstable (Roberto C. Sanchez)
[2019-02-24] nss 2:3.42.1-1 MIGRATED to testing (Debian testing watch)
[2019-02-13] Accepted nss 2:3.42.1-1 (source) into unstable (Mike Hommey)
[2019-02-04] nss 2:3.42-1 MIGRATED to testing (Debian testing watch)
[2019-01-30] Accepted nss 2:3.42-1 (source) into unstable (Mike Hommey)
[2018-12-18] nss 2:3.41-1 MIGRATED to testing (Debian testing watch)
[2018-12-12] Accepted nss 2:3.41-1 (source) into unstable (Mike Hommey)
[2018-12-01] nss 2:3.40-1 MIGRATED to testing (Debian testing watch)
[2018-11-26] Accepted nss 2:3.40-1 (source) into unstable (Mike Hommey)
[2018-09-14] nss 2:3.39-1 MIGRATED to testing (Debian testing watch)
[2018-09-08] Accepted nss 2:3.39-1 (source) into unstable (Mike Hommey)
[2018-06-30] nss 2:3.38-1 MIGRATED to testing (Debian testing watch)
[2018-06-24] Accepted nss 2:3.38-1 (source) into unstable (Mike Hommey)
[2018-06-02] nss 2:3.37.1-1 MIGRATED to testing (Debian testing watch)
[2018-05-27] Accepted nss 2:3.37.1-1 (source) into unstable (Mike Hommey)
[2018-05-13] Accepted nss 2:3.37-1 (source) into unstable (Mike Hommey)
[2018-04-16] nss 2:3.36.1-1 MIGRATED to testing (Debian testing watch)
[2018-04-10] Accepted nss 2:3.36.1-1 (source) into unstable (Mike Hommey)
[2018-04-07] Accepted nss 2:3.36-1 (source) into unstable (Mike Hommey)
[2018-02-03] nss 2:3.35-2 MIGRATED to testing (Debian testing watch)
[2018-01-29] Accepted nss 2:3.35-2 (source) into unstable (Mike Hommey)
[2018-01-29] Accepted nss 2:3.35-1 (source) into unstable (Mike Hommey)
[2018-01-10] nss 2:3.34.1-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 36 38
RC: 0
I&N: 24 25
M&W: 12 13
F&P: 0
patch: 7

links

homepage
buildd: logs, checks, clang, reproducibility, cross
popcon
browse source code
edit tags
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2:3.45-1ubuntu2
9 bugs
patches for 2:3.45-1ubuntu2