Debian Package Tracker

general

source: nss (main)
version: 2:3.49-1
maintainer: Maintainers of Mozilla-related packages (DMD)
uploaders: Mike Hommey [DMD]
arch: any
std-ver: 4.1.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2:3.26-1+debu8u3
o-o-sec: 2:3.26-1+debu8u10
oldstable: 2:3.26.2-1.1+deb9u1
old-sec: 2:3.26.2-1.1+deb9u1
stable: 2:3.42.1-1+deb10u1
stable-sec: 2:3.42.1-1+deb10u2
stable-p-u: 2:3.42.1-1+deb10u2
testing: 2:3.45-1
unstable: 2:3.49-1

versioned links

2:3.26-1+debu8u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:3.26-1+debu8u10: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:3.26.2-1.1+deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:3.42.1-1+deb10u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:3.42.1-1+deb10u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:3.45-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:3.48-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:3.49-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libnss3 (9 bugs: 0, 9, 0, 0)
libnss3-dev (4 bugs: 0, 2, 2, 0)
libnss3-tools (1 bugs: 0, 1, 0, 0)

action needed

Multiarch hinter reports 1 issue(s) high

There are issues with the multiarch metadata for this package.

libnss3-dev conflicts on /usr/bin/nss-config on any two of amd64, arm64, armel, i386, and 4 more

Created: 2016-09-14 Last update: 2020-01-21 21:34

A new upstream version is available: 3.49.1 high

A new upstream version 3.49.1 is available, you should consider packaging it.

Created: 2020-01-17 Last update: 2020-01-21 20:11

2 security issues in buster high

There are 2 open security issues in buster.

2 important issues:

CVE-2019-17006:
CVE-2019-17023: After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.

Please fix them.

Created: 2019-12-27 Last update: 2020-01-11 06:34

3 security issues in bullseye high

There are 3 open security issues in bullseye.

3 important issues:

CVE-2019-17006:
CVE-2019-11745: When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.
CVE-2019-17023: After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.

Please fix them.

Created: 2019-11-24 Last update: 2020-01-11 06:34

4 security issues in jessie high

There are 4 open security issues in jessie.

1 important issue:

CVE-2019-17023: After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.

3 issues skipped by the security teams:

CVE-2018-12384: When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.
CVE-2019-11727: A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.
CVE-2016-9074: An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

Please fix them.

Created: 2016-11-16 Last update: 2020-01-11 06:34

10 security issues in stretch high

There are 10 open security issues in stretch.

6 important issues:

CVE-2018-18508:
CVE-2018-12404: A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.
CVE-2019-17006:
CVE-2019-17007:
CVE-2019-11745: When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.
CVE-2019-17023: After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.

4 issues skipped by the security teams:

CVE-2018-12384: When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.
CVE-2019-11727: A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.
CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
CVE-2019-11719: When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Please fix them.

Created: 2018-09-04 Last update: 2020-01-11 06:34

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2020-01-14 Last update: 2020-01-22 00:41

8 bugs tagged patch in the BTS normal

The BTS contains patches fixing 8 bugs, consider including or untagging them.

Created: 2019-04-01 Last update: 2020-01-22 00:34

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2018-09-11 Last update: 2020-01-21 22:44

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2017-10-26 Last update: 2017-10-26 07:22

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.5.0 instead of 4.1.4).

Created: 2018-08-20 Last update: 2020-01-21 05:06

testing migrations

excuses:
- Migration status for nss (2:3.45-1 to 2:3.49-1): BLOCKED: Maybe temporary, maybe blocked but Britney is missing information (check below)
- Issues preventing migration:
- missing build on armhf
- Additional info:
- Piuparts tested OK - https://piuparts.debian.org/sid/source/n/nss.html
- 13 days old (needed 5 days)
- Not considered

news

[rss feed]

[2020-01-09] Accepted nss 2:3.49-1 (source) into unstable (Mike Hommey)
[2020-01-06] Accepted nss 2:3.26-1+debu8u10 (source amd64) into oldoldstable (Markus Koschany)
[2019-12-28] Accepted nss 2:3.48-1 (source) into unstable (Mike Hommey)
[2019-12-07] Accepted nss 2:3.42.1-1+deb10u2 (source amd64) into proposed-updates->stable-new, proposed-updates (Moritz Mühlenhoff)
[2019-12-06] Accepted nss 2:3.42.1-1+deb10u2 (source amd64) into stable->embargoed, stable (Moritz Mühlenhoff)
[2019-12-04] Accepted nss 2:3.47.1-1 (source) into unstable (Mike Hommey)
[2019-11-29] Accepted nss 2:3.26-1+debu8u9 (source amd64) into oldoldstable (Mike Gabriel)
[2019-11-29] Accepted nss 2:3.26-1+debu8u8 (source amd64) into oldoldstable (Mike Gabriel)
[2019-11-25] Accepted nss 2:3.26-1+debu8u7 (source amd64) into oldoldstable (Roberto C. Sanchez)
[2019-10-23] Accepted nss 2:3.47-1 (source) into unstable (Mike Hommey)
[2019-08-31] Accepted nss 2:3.42.1-1+deb10u1 (source amd64) into proposed-updates->stable-new, proposed-updates (Moritz Mühlenhoff)
[2019-08-22] Accepted nss 2:3.26-1+debu8u6 (source amd64) into oldoldstable (Markus Koschany)
[2019-07-20] Accepted nss 2:3.26-1+debu8u5 (source amd64) into oldoldstable (Roberto C. Sanchez)
[2019-07-16] nss 2:3.45-1 MIGRATED to testing (Debian testing watch)
[2019-07-09] Accepted nss 2:3.45-1 (source) into unstable (Mike Hommey)
[2019-06-04] Accepted nss 2:3.44+really3.42.1-2 (source) into unstable (Mike Hommey)
[2019-06-02] Accepted nss 2:3.44.0-1 (source) into experimental (Mike Hommey)
[2019-06-02] Accepted nss 2:3.44+really3.42.1-1 (source) into unstable (Mike Hommey)
[2019-06-01] Accepted nss 2:3.44-1 (source) into unstable (Mike Hommey)
[2019-03-05] Accepted nss 2:3.26-1+debu8u4 (source amd64) into oldstable (Roberto C. Sanchez)
[2019-02-24] nss 2:3.42.1-1 MIGRATED to testing (Debian testing watch)
[2019-02-13] Accepted nss 2:3.42.1-1 (source) into unstable (Mike Hommey)
[2019-02-04] nss 2:3.42-1 MIGRATED to testing (Debian testing watch)
[2019-01-30] Accepted nss 2:3.42-1 (source) into unstable (Mike Hommey)
[2018-12-18] nss 2:3.41-1 MIGRATED to testing (Debian testing watch)
[2018-12-12] Accepted nss 2:3.41-1 (source) into unstable (Mike Hommey)
[2018-12-01] nss 2:3.40-1 MIGRATED to testing (Debian testing watch)
[2018-11-26] Accepted nss 2:3.40-1 (source) into unstable (Mike Hommey)
[2018-09-14] nss 2:3.39-1 MIGRATED to testing (Debian testing watch)
[2018-09-08] Accepted nss 2:3.39-1 (source) into unstable (Mike Hommey)

bugs [bug history graph]

all: 37 39
RC: 0
I&N: 25 26
M&W: 12 13
F&P: 0
patch: 8

links

homepage
buildd: logs, checks, clang, reproducibility, cross
popcon
browse source code
edit tags
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2:3.48-1ubuntu1
9 bugs
patches for 2:3.48-1ubuntu1