Debian Package Tracker

general

source: nss (main)
version: 2:3.45-1
maintainer: Maintainers of Mozilla-related packages (DMD)
uploaders: Mike Hommey [DMD]
arch: any
std-ver: 4.1.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2:3.26-1+debu8u3
o-o-sec: 2:3.26-1+debu8u6
oldstable: 2:3.26.2-1.1+deb9u1
old-sec: 2:3.26.2-1.1+deb9u1
stable: 2:3.42.1-1+deb10u1
testing: 2:3.45-1
unstable: 2:3.45-1

versioned links

2:3.26-1+debu8u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:3.26-1+debu8u6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:3.26.2-1.1+deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:3.42.1-1+deb10u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:3.45-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libnss3 (9 bugs: 0, 9, 0, 0)
libnss3-dev (4 bugs: 0, 2, 2, 0)
libnss3-tools (1 bugs: 0, 1, 0, 0)

action needed

Multiarch hinter reports 1 issue(s) high

There are issues with the multiarch metadata for this package.

libnss3-dev conflicts on /usr/bin/nss-config on any two of amd64, arm64, armel, armhf, and 6 more

Created: 2016-09-14 Last update: 2019-10-16 17:54

A new upstream version is available: 3.46.1 high

A new upstream version 3.46.1 is available, you should consider packaging it.

Created: 2019-08-31 Last update: 2019-10-16 17:41

lintian reports 2 errors and 44 warnings high

Lintian reports 2 errors and 44 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2019-08-26 Last update: 2019-09-30 01:17

6 security issues in stretch high

There are 6 open security issues in stretch.

2 important issues:

CVE-2018-18508:
CVE-2018-12404: A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.

4 issues skipped by the security teams:

CVE-2018-12384: When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.
CVE-2019-11727: A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.
CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
CVE-2019-11719: When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Please fix them.

Created: 2018-09-04 Last update: 2019-09-07 16:09

7 bugs tagged patch in the BTS normal

The BTS contains patches fixing 7 bugs, consider including or untagging them.

Created: 2019-04-01 Last update: 2019-10-16 20:33

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2018-09-11 Last update: 2019-10-16 17:53

3 ignored security issues in jessie low

There are 3 open security issues in jessie.

3 issues skipped by the security teams:

CVE-2018-12384: When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.
CVE-2019-11727: A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.
CVE-2016-9074: An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

Please fix them.

Created: 2016-11-16 Last update: 2019-09-07 16:09

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2017-10-26 Last update: 2017-10-26 07:22

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.4.1 instead of 4.1.4).

Created: 2018-08-20 Last update: 2019-09-29 23:40

news

[rss feed]

[2019-08-31] Accepted nss 2:3.42.1-1+deb10u1 (source amd64) into proposed-updates->stable-new, proposed-updates (Moritz Mühlenhoff)
[2019-08-22] Accepted nss 2:3.26-1+debu8u6 (source amd64) into oldoldstable (Markus Koschany)
[2019-07-20] Accepted nss 2:3.26-1+debu8u5 (source amd64) into oldoldstable (Roberto C. Sanchez)
[2019-07-16] nss 2:3.45-1 MIGRATED to testing (Debian testing watch)
[2019-07-09] Accepted nss 2:3.45-1 (source) into unstable (Mike Hommey)
[2019-06-04] Accepted nss 2:3.44+really3.42.1-2 (source) into unstable (Mike Hommey)
[2019-06-02] Accepted nss 2:3.44.0-1 (source) into experimental (Mike Hommey)
[2019-06-02] Accepted nss 2:3.44+really3.42.1-1 (source) into unstable (Mike Hommey)
[2019-06-01] Accepted nss 2:3.44-1 (source) into unstable (Mike Hommey)
[2019-03-05] Accepted nss 2:3.26-1+debu8u4 (source amd64) into oldstable (Roberto C. Sanchez)
[2019-02-24] nss 2:3.42.1-1 MIGRATED to testing (Debian testing watch)
[2019-02-13] Accepted nss 2:3.42.1-1 (source) into unstable (Mike Hommey)
[2019-02-04] nss 2:3.42-1 MIGRATED to testing (Debian testing watch)
[2019-01-30] Accepted nss 2:3.42-1 (source) into unstable (Mike Hommey)
[2018-12-18] nss 2:3.41-1 MIGRATED to testing (Debian testing watch)
[2018-12-12] Accepted nss 2:3.41-1 (source) into unstable (Mike Hommey)
[2018-12-01] nss 2:3.40-1 MIGRATED to testing (Debian testing watch)
[2018-11-26] Accepted nss 2:3.40-1 (source) into unstable (Mike Hommey)
[2018-09-14] nss 2:3.39-1 MIGRATED to testing (Debian testing watch)
[2018-09-08] Accepted nss 2:3.39-1 (source) into unstable (Mike Hommey)
[2018-06-30] nss 2:3.38-1 MIGRATED to testing (Debian testing watch)
[2018-06-24] Accepted nss 2:3.38-1 (source) into unstable (Mike Hommey)
[2018-06-02] nss 2:3.37.1-1 MIGRATED to testing (Debian testing watch)
[2018-05-27] Accepted nss 2:3.37.1-1 (source) into unstable (Mike Hommey)
[2018-05-13] Accepted nss 2:3.37-1 (source) into unstable (Mike Hommey)
[2018-04-16] nss 2:3.36.1-1 MIGRATED to testing (Debian testing watch)
[2018-04-10] Accepted nss 2:3.36.1-1 (source) into unstable (Mike Hommey)
[2018-04-07] Accepted nss 2:3.36-1 (source) into unstable (Mike Hommey)
[2018-02-03] nss 2:3.35-2 MIGRATED to testing (Debian testing watch)
[2018-01-29] Accepted nss 2:3.35-2 (source) into unstable (Mike Hommey)

bugs [bug history graph]

all: 36 38
RC: 0
I&N: 24 25
M&W: 12 13
F&P: 0
patch: 7

links

homepage
lintian (2, 44)
buildd: logs, checks, clang, reproducibility, cross
popcon
browse source code
edit tags
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2:3.45-1ubuntu2
9 bugs
patches for 2:3.45-1ubuntu2