Debian Package Tracker

general

source: nss (main)
version: 2:3.52-1
maintainer: Maintainers of Mozilla-related packages (DMD)
uploaders: Mike Hommey [DMD]
arch: any
std-ver: 4.1.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2:3.26-1+debu8u3
o-o-sec: 2:3.26-1+debu8u10
oldstable: 2:3.26.2-1.1+deb9u1
old-sec: 2:3.26.2-1.1+deb9u1
stable: 2:3.42.1-1+deb10u2
stable-sec: 2:3.42.1-1+deb10u2
testing: 2:3.49.1-1
unstable: 2:3.52-1

versioned links

2:3.26-1+debu8u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:3.26-1+debu8u10: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:3.26.2-1.1+deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:3.42.1-1+deb10u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:3.49.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:3.52-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libnss3 (9 bugs: 0, 9, 0, 0)
libnss3-dev (4 bugs: 0, 2, 2, 0)
libnss3-tools (1 bugs: 0, 1, 0, 0)

action needed

A new upstream version is available: 3.52.1 high

A new upstream version 3.52.1 is available, you should consider packaging it.

Created: 2020-05-22 Last update: 2020-05-27 06:32

Multiarch hinter reports 1 issue(s) high

There are issues with the multiarch metadata for this package.

libnss3-dev conflicts on /usr/bin/nss-config on amd64, arm64, and 7 more with 44 combinations

Created: 2016-09-14 Last update: 2020-05-27 02:01

3 security issues in buster high

There are 3 open security issues in buster.

3 important issues:

CVE-2019-17006:
CVE-2020-12399:
CVE-2019-17023: After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.

Please fix them.

Created: 2019-12-27 Last update: 2020-05-20 20:30

3 security issues in jessie high

There are 3 open security issues in jessie.

1 important issue:

CVE-2020-12399:

2 issues skipped by the security teams:

CVE-2018-12384: When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.
CVE-2019-11727: A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.

Please fix them.

Created: 2016-11-16 Last update: 2020-05-20 20:30

11 security issues in stretch high

There are 11 open security issues in stretch.

7 important issues:

CVE-2018-18508:
CVE-2018-12404: A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.
CVE-2019-17006:
CVE-2019-17007:
CVE-2019-11745: When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.
CVE-2020-12399:
CVE-2019-17023: After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.

4 issues skipped by the security teams:

CVE-2018-12384: When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.
CVE-2019-11727: A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.
CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
CVE-2019-11719: When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Please fix them.

Created: 2018-09-04 Last update: 2020-05-20 20:30

1 security issue in bullseye high

There is 1 open security issue in bullseye.

1 important issue:

CVE-2020-12399:

Please fix it.

Created: 2020-05-20 Last update: 2020-05-20 20:30

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2020-12399:

Please fix it.

Created: 2020-05-20 Last update: 2020-05-20 20:30

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2018-09-11 Last update: 2020-05-27 06:33

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2020-05-11 Last update: 2020-05-27 06:04

8 bugs tagged patch in the BTS normal

The BTS contains patches fixing 8 bugs, consider including or untagging them.

Created: 2020-02-26 Last update: 2020-05-27 06:01

lintian reports 3 warnings normal

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2020-05-21 Last update: 2020-05-21 00:06

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2017-10-26 Last update: 2017-10-26 07:22

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.5.0 instead of 4.1.4).

Created: 2018-08-20 Last update: 2020-05-06 07:09

testing migrations

excuses:
- Migration status for nss (2:3.49.1-1 to 2:3.52-1): BLOCKED: Maybe temporary, maybe blocked but Britney is missing information (check below)
- Issues preventing migration:
- missing build on mips64el
- missing build on s390x
- Additional info:
- Piuparts tested OK - https://piuparts.debian.org/sid/source/n/nss.html
- 21 days old (needed 5 days)
- Not considered

news

[rss feed]

[2020-05-05] Accepted nss 2:3.52-1 (source) into unstable (Mike Hommey)
[2020-04-08] Accepted nss 2:3.51-1 (source) into unstable (Mike Hommey)
[2020-02-12] Accepted nss 2:3.50-1 (source) into unstable (Mike Hommey)
[2020-01-27] nss 2:3.49.1-1 MIGRATED to testing (Debian testing watch)
[2020-01-22] Accepted nss 2:3.49.1-1 (source) into unstable (Mike Hommey)
[2020-01-09] Accepted nss 2:3.49-1 (source) into unstable (Mike Hommey)
[2020-01-06] Accepted nss 2:3.26-1+debu8u10 (source amd64) into oldoldstable (Markus Koschany)
[2019-12-28] Accepted nss 2:3.48-1 (source) into unstable (Mike Hommey)
[2019-12-07] Accepted nss 2:3.42.1-1+deb10u2 (source amd64) into proposed-updates->stable-new, proposed-updates (Moritz Mühlenhoff)
[2019-12-06] Accepted nss 2:3.42.1-1+deb10u2 (source amd64) into stable->embargoed, stable (Moritz Mühlenhoff)
[2019-12-04] Accepted nss 2:3.47.1-1 (source) into unstable (Mike Hommey)
[2019-11-29] Accepted nss 2:3.26-1+debu8u9 (source amd64) into oldoldstable (Mike Gabriel)
[2019-11-29] Accepted nss 2:3.26-1+debu8u8 (source amd64) into oldoldstable (Mike Gabriel)
[2019-11-25] Accepted nss 2:3.26-1+debu8u7 (source amd64) into oldoldstable (Roberto C. Sanchez)
[2019-10-23] Accepted nss 2:3.47-1 (source) into unstable (Mike Hommey)
[2019-08-31] Accepted nss 2:3.42.1-1+deb10u1 (source amd64) into proposed-updates->stable-new, proposed-updates (Moritz Mühlenhoff)
[2019-08-22] Accepted nss 2:3.26-1+debu8u6 (source amd64) into oldoldstable (Markus Koschany)
[2019-07-20] Accepted nss 2:3.26-1+debu8u5 (source amd64) into oldoldstable (Roberto C. Sanchez)
[2019-07-16] nss 2:3.45-1 MIGRATED to testing (Debian testing watch)
[2019-07-09] Accepted nss 2:3.45-1 (source) into unstable (Mike Hommey)
[2019-06-04] Accepted nss 2:3.44+really3.42.1-2 (source) into unstable (Mike Hommey)
[2019-06-02] Accepted nss 2:3.44.0-1 (source) into experimental (Mike Hommey)
[2019-06-02] Accepted nss 2:3.44+really3.42.1-1 (source) into unstable (Mike Hommey)
[2019-06-01] Accepted nss 2:3.44-1 (source) into unstable (Mike Hommey)
[2019-03-05] Accepted nss 2:3.26-1+debu8u4 (source amd64) into oldstable (Roberto C. Sanchez)
[2019-02-24] nss 2:3.42.1-1 MIGRATED to testing (Debian testing watch)
[2019-02-13] Accepted nss 2:3.42.1-1 (source) into unstable (Mike Hommey)
[2019-02-04] nss 2:3.42-1 MIGRATED to testing (Debian testing watch)
[2019-01-30] Accepted nss 2:3.42-1 (source) into unstable (Mike Hommey)
[2018-12-18] nss 2:3.41-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 39 41
RC: 1
I&N: 26 27
M&W: 12 13
F&P: 0
patch: 8

links

homepage
lintian (0, 3)
buildd: logs, checks, clang, reproducibility, cross
popcon
browse source code
edit tags
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2:3.49.1-1ubuntu1
9 bugs
patches for 2:3.49.1-1ubuntu1