Commit Graph

158 Commits

Author SHA256 Message Date
Wolfgang Rosenauer
ee4c12609b - update to NSS 3.32.1
* no upstream changelog/releasenote provided

- update to NSS 3.32
  Notable changes
  * Various minor improvements and correctness fixes.
  * The Code Signing trust bit was turned off for all included root certificates.
  * The Websites (TLS/SSL) trust bit was turned off for the following
    root certificates:
    AddTrust Class 1 CA Root
    Swisscom Root CA 2
  * The following CA certificates were Removed:
    AddTrust Public CA Root
    AddTrust Qualified CA Root
    China Internet Network Information Center EV Certificates Root
    CNNIC ROOT
    ComSign Secured CA
    GeoTrust Global CA 2
    Secure Certificate Services
    Swisscom Root CA 1
    Swisscom Root EV CA 2
    Trusted Certificate Services
    UTN-USERFirst-Hardware
    UTN-USERFirst-Object
- requires NSPR 4.16

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=248
2017-09-21 07:14:07 +00:00
Wolfgang Rosenauer
7da2ef870f - update to NSS 3.31.1
* Potential deadlock when using an external PKCS#11 token (bmo#1381784)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=246
2017-09-12 08:58:38 +00:00
Wolfgang Rosenauer
279fac0f79 - removed obsolete nss-fix-hash.patch
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=244
2017-08-11 07:28:38 +00:00
Wolfgang Rosenauer
3acc6b79e5 - update to NSS 3.31
New functionality
  * Allow certificates to be specified by RFC7512 PKCS#11 URIs.
  * Allow querying a certificate object for its temporary or permanent
    storage status in a thread safe way.
  New functions
  * CERT_GetCertIsPerm - retrieve the permanent storage status attribute of a
    certificate in a thread safe way.
  * CERT_GetCertIsTemp - retrieve the temporary storage status attribute of a
    certificate in a thread safe way.
  * PK11_FindCertFromURI - find a certificate identified by the given URI.
  * PK11_FindCertsFromURI - find a list of certificates identified by the given
    URI.
  * PK11_GetModuleURI - retrieve the URI of the given module.
  * PK11_GetTokenURI - retrieve the URI of a token based on the given slot
    information.
  * PK11URI_CreateURI - create a new PK11URI object from a set of attributes.
  * PK11URI_DestroyURI - destroy a PK11URI object.
  * PK11URI_FormatURI - format a PK11URI object to a string.
  * PK11URI_GetPathAttribute - retrieve a path attribute with the given name.
  * PK11URI_GetQueryAttribute - retrieve a query attribute with the given name.
  * PK11URI_ParseURI - parse PKCS#11 URI and return a new PK11URI object.
  New macros
  * Several new macros that start with PK11URI_PATTR_ for path attributes defined
    in RFC7512.
  * Several new macros that start with PK11URI_QATTR_ for query attributes defined
    in RFC7512.
  Notable changes
  * The APIs that set a TLS version range have been changed to trim the requested
    range to the overlap with a systemwide crypto policy, if configured.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=243
2017-08-08 18:40:45 +00:00
Wolfgang Rosenauer
8a54093a7b - update to NSS 3.30.2
New Functionality
  * In the PKCS#11 root CA module (nssckbi), CAs with positive trust
    are marked with a new boolean attribute, CKA_NSS_MOZILLA_CA_POLICY,
    set to true. Applications that need to distinguish them from other
    other root CAs, may use the exported function PK11_HasAttributeSet.
  * Support for callback functions that can be used to monitor SSL/TLS
    alerts that are sent or received.
  New Functions
  * CERT_CompareAVA - performs a comparison of two CERTAVA structures,
    and returns a SECComparison result.
  * PK11_HasAttributeSet - allows to check if a PKCS#11 object in a
    given slot has a specific boolean attribute set.
  * SSL_AlertReceivedCallback - register a callback function, that will
    be called whenever an SSL/TLS alert is received
  * SSL_AlertSentCallback - register a callback function, that will be
    called whenever an SSL/TLS alert is sent
  * SSL_SetSessionTicketKeyPair - configures an asymmetric key pair,
    for use in wrapping session ticket keys, used by the server. This
    function currently only accepts an RSA public/private key pair.
  New Macros
  * PKCS12_AES_CBC_128, PKCS12_AES_CBC_192, PKCS12_AES_CBC_256
    cipher family identifiers corresponding to the PKCS#5 v2.1 AES
    based encryption schemes used in the PKCS#12 support in NSS
  * CKA_NSS_MOZILLA_CA_POLICY - identifier for a boolean PKCS#11
    attribute, that should be set to true, if a CA is present because
    of it's acceptance according to the Mozilla CA Policy
  Notable Changes
  * The TLS server code has been enhanced to support session tickets
    when no RSA certificate (e.g. only an ECDSA certificate) is configured.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=241
2017-04-26 21:50:12 +00:00
Wolfgang Rosenauer
607f63b358 (boo#1015499, bmo#1320695) (nss-bmo1320695.patch)
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=239
2017-04-12 21:31:19 +00:00
Wolfgang Rosenauer
c072bb869b - Allow use of session tickets when there is no ticket wrapping key
(boo#1015499, bmo#1320695)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=238
2017-04-12 21:26:25 +00:00
Wolfgang Rosenauer
32ecde7ac4 - update to NSS 3.29.5
* Rare crashes in the base 64 decoder and encoder were fixed.
    (bmo#1344380)
  * A carry over bug in the RNG was fixed. (bmo#1345089)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=237
2017-04-09 08:24:38 +00:00
Wolfgang Rosenauer
0fddc4108c - update to NSS 3.29.3
* enables TLS 1.3 by default
- TLS 1.3 was already enabled in 3.28.x builds for openSUSE.
  This build option was removed.
- required for Firefox 53

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=235
2017-03-22 22:17:03 +00:00
Wolfgang Rosenauer
11f3cdd1a0 Accepting request 479929 from home:rguenther:branches:mozilla:Factory
- Add nss-fix-hash.patch to fix hash computation (and build with
  GCC 7 which complains about shifts of boolean values).

OBS-URL: https://build.opensuse.org/request/show/479929
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=233
2017-03-16 13:54:28 +00:00
Wolfgang Rosenauer
521acd1a2e - update to NSS 3.28.3
* This is a patch release to fix binary compatibility issues.
    NSS version 3.28, 3.28.1 and 3.28.2 contained changes that were
    in violation with the NSS compatibility promise.
    ECParams, which is part of the public API of the freebl/softokn
    parts of NSS, had been changed to include an additional attribute.
    That size increase caused crashes or malfunctioning with applications
    that use that data structure directly, or indirectly through
    ECPublicKey, ECPrivateKey, NSSLOWKEYPublicKey, NSSLOWKEYPrivateKey,
    or potentially other data structures that reference ECParams.
    The change has been reverted to the original state in bug
    bmo#1334108.
    SECKEYECPublicKey had been extended with a new attribute, named
    "encoding". If an application passed type SECKEYECPublicKey to NSS
    (as part of SECKEYPublicKey), the NSS library read the uninitialized
    attribute. With this NSS release SECKEYECPublicKey.encoding is
    deprecated. NSS no longer reads the attribute, and will always
    set it to ECPoint_Undefined. See bug bmo#1340103.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=231
2017-02-20 11:58:02 +00:00
Wolfgang Rosenauer
563cf68233 - update to NSS 3.28.2
This is a stability and compatibility release. Below is a summary of
  the changes.
  * Fixed a NSS 3.28 regression in the signature scheme flexibility that
    causes connectivity issues between iOS 8 clients and NSS servers
    with ECDSA certificates (bmo#1334114)
  * Fixed a possible crash on some Windows systems (bmo#1323150)
  * Fixed a compatibility issue with TLS clients that do not provide a
    list of supported key exchange groups (bmo#1330612)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=228
2017-02-12 07:39:39 +00:00
Wolfgang Rosenauer
0dac9b9d86 - raised the minimum softokn/freebl version to 3.28 as reported in
boo#1021636

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=226
2017-01-25 10:29:48 +00:00
Wolfgang Rosenauer
d5e09fcf99 - update to NSS 3.28.1
No new functionality is introduced in this release. This is a patch release to
  update the list of root CA certificates and address a minor TLS compatibility
  issue that some applications experienced with NSS 3.28.
  * The following CA certificates were Removed
    CN = Buypass Class 2 CA 1
    CN = Root CA Generalitat Valenciana
    OU = RSA Security 2048 V3
  * The following CA certificates were Added
    OU = AC RAIZ FNMT-RCM
    CN = Amazon Root CA 1
    CN = Amazon Root CA 2
    CN = Amazon Root CA 3
    CN = Amazon Root CA 4
    CN = LuxTrust Global Root 2
    CN = Symantec Class 1 Public Primary Certification Authority - G4
    CN = Symantec Class 1 Public Primary Certification Authority - G6
    CN = Symantec Class 2 Public Primary Certification Authority - G4
    CN = Symantec Class 2 Public Primary Certification Authority - G6
  * The version number of the updated root CA list has been set to 2.11
  * A misleading assertion/alert has been removed when NSS tries to flush data
    to the peer but the connection was already reset.
- update to NSS 3.28
  New functionality:
  * NSS includes support for TLS 1.3 draft -18. This includes a number
    of improvements to TLS 1.3:
    - The signed certificate timestamp, used in certificate
      transparency, is supported in TLS 1.3.
    - Key exporters for TLS 1.3 are supported. This includes the early
      key exporter, which can be used if 0-RTT is enabled. Note that

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=225
2017-01-18 22:18:23 +00:00
Wolfgang Rosenauer
d90646d547 - update to NSS 3.26.2
* required for Firefox 50.0
  Changes in 3.26
  New Functionality:
  * the selfserv test utility has been enhanced to support ALPN
    (HTTP/1.1) and 0-RTT
  * added support for the System-wide crypto policy available on
    Fedora Linux see http://fedoraproject.org/wiki/Changes/CryptoPolicy
  * introduced build flag NSS_DISABLE_LIBPKIX that allows compilation
    of NSS without the libpkix library
  Notable Changes:
  * The following CA certificate was Added
    CN = ISRG Root X1
  * NPN is disabled and ALPN is enabled by default
  * the NSS test suite now completes with the experimental TLS 1.3
    code enabled
  * several test improvements and additions, including a NIST known answer test
  Changes in 3.26.2
  * MD5 signature algorithms sent by the server in CertificateRequest
    messages are now properly ignored. Previously, with rare server
    configurations, an MD5 signature algorithm might have been selected
    for client authentication and caused the client to abort the
    connection soon after.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=223
2016-11-14 12:44:27 +00:00
Wolfgang Rosenauer
eae31781bc - update to NSS 3.25
New functionality:
  * Implemented DHE key agreement for TLS 1.3
  * Added support for ChaCha with TLS 1.3
  * Added support for TLS 1.2 ciphersuites that use SHA384 as the PRF
  * In previous versions, when using client authentication with TLS 1.2,
    NSS only supported certificate_verify messages that used the same
    signature hash algorithm as used by the PRF. This limitation has
    been removed.
  * Several functions have been added to the public API of the
    NSS Cryptoki Framework.
  New functions:
  * NSSCKFWSlot_GetSlotID
  * NSSCKFWSession_GetFWSlot
  * NSSCKFWInstance_DestroySessionHandle
  * NSSCKFWInstance_FindSessionHandle
  Notable changes:
  * An SSL socket can no longer be configured to allow both TLS 1.3 and SSLv3
  * Regression fix: NSS no longer reports a failure if an application
    attempts to disable the SSLv2 protocol.
  * The list of trusted CA certificates has been updated to version 2.8
  * The following CA certificate was Removed
    Sonera Class1 CA
  * The following CA certificates were Added
    Hellenic Academic and Research Institutions RootCA 2015
    Hellenic Academic and Research Institutions ECC RootCA 2015
    Certplus Root CA G1
    Certplus Root CA G2
    OpenTrust Root CA G1
    OpenTrust Root CA G2

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=221
2016-09-19 19:25:03 +00:00
Wolfgang Rosenauer
a4d9b31978 - fix build on certain toolchains (nss-uninitialized.patch)
jarfile.c:805:13: error: 'it' may be used uninitialized in this
  function [-Werror=maybe-uninitialized]

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=219
2016-08-22 12:58:09 +00:00
Wolfgang Rosenauer
10edbe58e9 - also sign libfreeblpriv3.so to allow FIPS mode again (boo#992236)
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=217
2016-08-05 05:48:45 +00:00
Wolfgang Rosenauer
05db003205 - update to NSS 3.24
New functionality:
  * NSS softoken has been updated with the latest National Institute
    of Standards and Technology (NIST) guidance (as of 2015):
    - Software integrity checks and POST functions are executed on
      shared library load. These checks have been disabled by default,
      as they can cause a performance regression. To enable these
      checks, you must define symbol NSS_FORCE_FIPS when building NSS.
    - Counter mode and Galois/Counter Mode (GCM) have checks to
      prevent counter overflow.
    - Additional CSPs are zeroed in the code.
    - NSS softoken uses new guidance for how many Rabin-Miller tests
      are needed to verify a prime based on prime size.
  * NSS softoken has also been updated to allow NSS to run in FIPS
    Level 1 (no password). This mode is triggered by setting the
    database password to the empty string. In FIPS mode, you may move
    from Level 1 to Level 2 (by setting an appropriate password),
    but not the reverse.
  * A SSL_ConfigServerCert function has been added for configuring
    SSL/TLS server sockets with a certificate and private key. Use
    this new function in place of SSL_ConfigSecureServer,
    SSL_ConfigSecureServerWithCertChain, SSL_SetStapledOCSPResponses,
    and SSL_SetSignedCertTimestamps. SSL_ConfigServerCert automatically
    determines the certificate type from the certificate and private key.
    The caller is no longer required to use SSLKEAType explicitly to
    select a "slot" into which the certificate is configured (which
    incorrectly identifies a key agreement type rather than a certificate).
    Separate functions for configuring Online Certificate Status Protocol
    (OCSP) responses or Signed Certificate Timestamps are not needed,
    since these can be added to the optional SSLExtraServerCertData struct

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=216
2016-07-31 10:48:39 +00:00
Wolfgang Rosenauer
ec6a54a194 Accepting request 400673 from home:AndreasStieger:branches:mozilla:Factory
CVE-2016-1950 was already fixed in 3.22.3, add there.
Add CVE-2016-2834 to 3.23 section

OBS-URL: https://build.opensuse.org/request/show/400673
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=214
2016-06-08 12:57:14 +00:00
Wolfgang Rosenauer
f2c3469da1 - update to NSS 3.23
New functionality:
  * ChaCha20/Poly1305 cipher and TLS cipher suites now supported
  * Experimental-only support TLS 1.3 1-RTT mode (draft-11).
    This code is not ready for production use.
  New functions:
  * SSL_SetDowngradeCheckVersion - Set maximum version for new
    ServerRandom anti-downgrade mechanism. Clients that perform a
    version downgrade (which is generally a very bad idea) call this
    with the highest version number that they possibly support.
    This gives them access to the version downgrade protection from
    TLS 1.3.
  Notable changes:
  * The copy of SQLite shipped with NSS has been updated to version
    3.10.2
  * The list of TLS extensions sent in the TLS handshake has been
    reordered to increase compatibility of the Extended Master Secret
    with with servers
  * The build time environment variable NSS_ENABLE_ZLIB has been
    renamed to NSS_SSL_ENABLE_ZLIB
  * The build time environment variable NSS_DISABLE_CHACHAPOLY was
    added, which can be used to prevent compilation of the
    ChaCha20/Poly1305 code.
  * The following CA certificates were Removed
    - Staat der Nederlanden Root CA
    - NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado
    - NetLock Kozjegyzoi (Class A) Tanusitvanykiado
    - NetLock Uzleti (Class B) Tanusitvanykiado
    - NetLock Expressz (Class C) Tanusitvanykiado
    - VeriSign Class 1 Public PCA – G2

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=212
2016-05-26 20:20:47 +00:00
Wolfgang Rosenauer
fb6ae8911f Accepting request 390595 from home:michel_mno:branches:mozilla:Factory
-  add nss_gcc6_change.patch
to avoid build error in https://build.opensuse.org/package/show/openSUSE:Factory:Staging:Gcc6/mozilla-nss

OBS-URL: https://build.opensuse.org/request/show/390595
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=211
2016-04-18 20:51:42 +00:00
Wolfgang Rosenauer
a9a3622567 - update to NSS 3.22.3
* required for Firefox 46.0
  * Increase compatibility of TLS extended master secret,
    don't send an empty TLS extension last in the handshake
    (bmo#1243641)

- update to NSS 3.22.2
  New functionality:
  * RSA-PSS signatures are now supported (bmo#1215295)
  * Pseudorandom functions based on hashes other than SHA-1 are now supported
  * Enforce an External Policy on NSS from a config file (bmo#1009429)
  New functions:
  * PK11_SignWithMechanism - an extended version PK11_Sign()
  * PK11_VerifyWithMechanism - an extended version of PK11_Verify()
  * SSL_PeerSignedCertTimestamps - Get signed_certificate_timestamp
    TLS extension data
  * SSL_SetSignedCertTimestamps - Set signed_certificate_timestamp
    TLS extension data
  New types:
  * ssl_signed_cert_timestamp_xtn is added to SSLExtensionType
  * Constants for several object IDs are added to SECOidTag
  New macros:
  * SSL_ENABLE_SIGNED_CERT_TIMESTAMPS
  * NSS_USE_ALG_IN_SSL
  * NSS_USE_POLICY_IN_SSL
  * NSS_RSA_MIN_KEY_SIZE
  * NSS_DH_MIN_KEY_SIZE
  * NSS_DSA_MIN_KEY_SIZE
  * NSS_TLS_VERSION_MIN_POLICY
  * NSS_TLS_VERSION_MAX_POLICY

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=209
2016-04-05 05:56:14 +00:00
Wolfgang Rosenauer
4db1acbc24 - update to NSS 3.21.1 (bmo#969894)
* MFSA 2016-35/CVE-2016-1950 (bmo#1245528)
    Buffer overflow during ASN.1 decoding in NSS
    (fixed by requiring 3.21.1)
  * MFSA 2016-36/CVE-2016-1979 (bmo#1185033)
    Use-after-free during processing of DER encoded keys in NSS
    (fixed by requiring 3.21.1)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=207
2016-03-08 22:39:49 +00:00
Wolfgang Rosenauer
83afc800c1 - update to NSS 3.21.1
* required for Firefox 45.0
  * no upstream release notes available

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=206
2016-03-07 15:44:49 +00:00
Wolfgang Rosenauer
e133fb3c74 - added nss-bmo1236011.patch to fix compiler error (bmo#1236011)
- disabled testsuite as it currently breaks (bmo#1236340)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=204
2016-01-26 22:49:44 +00:00
Wolfgang Rosenauer
a13639ab95 - update to NSS 3.21
* required for Firefox 44.0
  New functionality:
  * certutil now supports a --rename option to change a nickname (bmo#1142209)
  * TLS extended master secret extension (RFC 7627) is supported (bmo#1117022)
  * New info functions added for use during mid-handshake callbacks (bmo#1084669)
  New Functions:
  * NSS_OptionSet - sets NSS global options
  * NSS_OptionGet - gets the current value of NSS global options
  * SECMOD_CreateModuleEx - Create a new SECMODModule structure from module name
    string, module parameters string, NSS specific parameters string, and NSS
    configuration parameter string. The module represented by the module
    structure is not loaded. The difference with SECMOD_CreateModule is the new
    function handles NSS configuration parameter strings.
  * SSL_GetPreliminaryChannelInfo - obtains information about a TLS channel prior
    to the handshake being completed, for use with the callbacks that are invoked
    during the handshake
  * SSL_SignaturePrefSet - configures the enabled signature and hash algorithms
    for TLS
  * SSL_SignaturePrefGet - retrieves the currently configured signature and hash
    algorithms
  * SSL_SignatureMaxCount - obtains the maximum number signature algorithms that
    can be configured with SSL_SignaturePrefSet
  * NSSUTIL_ArgParseModuleSpecEx - takes a module spec and breaks it into shared
    library string, module name string, module parameters string, NSS specific
    parameters string, and NSS configuration parameter strings. The returned
    strings must be freed by the caller. The difference with
    NSS_ArgParseModuleSpec is the new function handles NSS configuration
    parameter strings.
  * NSSUTIL_MkModuleSpecEx - take a shared library string, module name string,

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=203
2016-01-26 06:30:20 +00:00
Wolfgang Rosenauer
016b870c09 * MFSA 2015-150/CVE-2015-7575 (bmo#1158489)
MD5 signatures accepted within TLS 1.2 ServerKeyExchange in
    server signature

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=200
2015-12-26 07:22:03 +00:00
Wolfgang Rosenauer
3463e0c188 - update to NSS 3.20.2 (bnc#959888)
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=199
2015-12-23 12:24:51 +00:00
Wolfgang Rosenauer
7b02230ef1 - update to NSS 3.20.2
- update to NSS 3.20.1 (bnc#952810)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=198
2015-12-20 10:13:48 +00:00
Wolfgang Rosenauer
262b0bfec9 - update to NSS 4.20.2
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=197
2015-12-19 17:14:46 +00:00
Wolfgang Rosenauer
aa77e12284 - update to NSS 4.20.1 (bnc#952810)
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=195
2015-11-03 19:46:10 +00:00
Wolfgang Rosenauer
bac12b7d9e * MFSA 2015-133/CVE-2015-7181/CVE-2015-7182 (bmo#1192028, bmo#1202868)
memory corruption issues

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=194
2015-11-03 17:24:16 +00:00
Wolfgang Rosenauer
107f9eab33 - update to NSS 4.20.1
* requires NSPR 4.10.10

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=193
2015-10-31 09:29:52 +00:00
Wolfgang Rosenauer
4453cedcca Accepting request 333502 from Java:Factory
Distribute libfreebl.a along other static libraries. It is needed for java 7 Sun Elliptical Curve Crypto provider

OBS-URL: https://build.opensuse.org/request/show/333502
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=191
2015-09-24 17:37:48 +00:00
Wolfgang Rosenauer
371f571e08 - update to NSS 3.20
New functionality:
  * The TLS library has been extended to support DHE ciphersuites in
    server applications.
  New Functions:
  * SSL_DHEGroupPrefSet - Configure the set of allowed/enabled DHE group
    parameters that can be used by NSS for a server socket.
  * SSL_EnableWeakDHEPrimeGroup - Enable the use of weak DHE group
    parameters that are smaller than the library default's minimum size.
  New Types:
  * SSLDHEGroupType - Enumerates the set of DHE parameters embedded in
    NSS that can be used with function SSL_DHEGroupPrefSet.
  New Macros:
  * SSL_ENABLE_SERVER_DHE - A socket option user to enable or disable
    DHE ciphersuites for a server socket.
  Notable Changes:
  * For backwards compatibility reasons, the server side implementation
    of the TLS library keeps all DHE ciphersuites disabled by default.
    They can be enabled with the new socket option SSL_ENABLE_SERVER_DHE
    and the SSL_OptionSet or the SSL_OptionSetDefault API.
  * The server side implementation of the TLS implementation does not
    support session tickets when using a DHE ciphersuite (see bmo#1174677).
  * Support for the following ciphersuites has been added:
    - TLS_DHE_DSS_WITH_AES_128_GCM_SHA256
    - TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
    - TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
  * By default, the server side TLS implementation will use DHE
    parameters with a size of 2048 bits when using DHE ciphersuites.
  * NSS embeds fixed DHE parameters sized 2048, 3072, 4096, 6144 and
    8192 bits, which were copied from version 08 of the Internet-Draft

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=190
2015-09-24 10:20:12 +00:00
Wolfgang Rosenauer
e87238be07 Accepting request 333436 from Java:Factory
Add blapi.h and algmac.h, in order to be able to build sunec.jar in java 7

OBS-URL: https://build.opensuse.org/request/show/333436
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=189
2015-09-24 09:37:13 +00:00
Wolfgang Rosenauer
11da47024a (MFSA 2015-70/CVE-2015-4000)
* NSS incorrectly permits skipping of ServerKeyExchange
    (bmo#1086145) (MFSA 2015-71/CVE-2015-2721)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=187
2015-07-03 05:51:39 +00:00
Wolfgang Rosenauer
b075d41608 Accepting request 313427 from home:msmeissn:branches:mozilla:Factory
- as the .chk files are contained in libfreebl3 and libsoftokn
  directly, provide the -hmac alias names to help :42 building.

OBS-URL: https://build.opensuse.org/request/show/313427
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=185
2015-06-24 17:52:00 +00:00
Wolfgang Rosenauer
c13c2fe84e - update to 3.19.2
* required for Firefox 39.0
  * No new functionality is introduced in this release. This release
    addresses a backwards compatibility issue with the NSS 3.19.1
    release.
  * In NSS 3.19.1, the minimum key sizes that the freebl cryptographic
    implementation (part of the softoken cryptographic module used
    by default by NSS) was willing to generate or use was increased
    - for RSA keys, to 512 bits, and for DH keys, 1023 bits. This
    was done as part of a security fix for Bug 1138554 / CVE-2015-4000.
    Applications that requested or attempted to use keys smaller
    then the minimum size would fail. However,  this change in behaviour
    unintentionally broke existing NSS applications that need to
    generate or use such keys, via APIs such as
    SECKEY_CreateRSAPrivateKey or SECKEY_CreateDHPrivateKey.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=184
2015-06-23 06:04:19 +00:00
Wolfgang Rosenauer
468ec67421 Notable Changes:
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=182
2015-06-01 07:53:45 +00:00
Wolfgang Rosenauer
8cb655bd59 - update to 3.19.1
No new functionality is introduced in this release. This patch
  release includes a fix for the recently published logjam attack.
Notable Changes:
  * The minimum strength of keys that libssl will accept for
    finite field algorithms (RSA, Diffie-Hellman, and DSA) have
    been increased to 1023 bits (bmo#1138554).
  * NSS reports the bit length of keys more accurately.  Thus,
    the SECKEY_PublicKeyStrength and SECKEY_PublicKeyStrengthInBits
    functions could report smaller values for values that have
    leading zero values. This affects the key strength values that
    are reported by SSL_GetChannelInfo.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=180
2015-05-31 13:26:05 +00:00
Wolfgang Rosenauer
fac2c66773 - update to 3.19
* Firefox target release 39
  New functionality:
  * For some certificates, such as root CA certificates, that don't
    embed any constraints, NSS might impose additional constraints,
    such as name constraints. A new API has been added that allows
    to lookup imposed constraints.
  * It is possible to override the directory in which the NSS build
    system will look for the sqlite library.
  New Functions:
  * CERT_GetImposedNameConstraints
  Notable Changes:
  * The SSL 3 protocol has been disabled by default.
  * NSS now more strictly validates TLS extensions and will fail a
    handshake that contains malformed extensions.
  * Fixed a bug related to the ordering of TLS handshake messages.
  * In TLS 1.2 handshakes, NSS advertises support for the SHA512
    hash algorithm, in order to be compatible with TLS servers
    that use certificates with a SHA512 signature.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=179
2015-05-23 08:54:34 +00:00
Wolfgang Rosenauer
aac1edd658 - update to 3.18.1
* Firefox target release 38
  * No new functionality is introduced in this release.
  Notable Changes:
  * The following CA certificate had the Websites and Code Signing
    trust bits restored to their original state to allow more time
    to develop a better transition strategy for affected sites:
    - OU = Equifax Secure Certificate Authority
  * The following CA certificate was removed:
    - CN = e-Guven Kok Elektronik Sertifika Hizmet Saglayicisi
  * The following intermediate CA certificate has been added as
    actively distrusted because it was mis-used to issue certificates
    for domain names the holder did not own or control:
    - CN=MCSHOLDING TEST, O=MCSHOLDING, C=EG
  * The version number of the updated root CA list has been set
    to 2.4

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=177
2015-04-23 06:38:33 +00:00
Wolfgang Rosenauer
61e5bbef43 - add the changes file as source so the .src.rpm builds (used for
fake build time)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=176
2015-04-03 20:30:47 +00:00
Wolfgang Rosenauer
7803242e62 - update to 3.18
* Firefox target release 38
  New functionality:
  * When importing certificates and keys from a PKCS#12 source,
    it's now possible to override the nicknames, prior to importing
    them into the NSS database, using new API
    SEC_PKCS12DecoderRenameCertNicknames.
  * The tstclnt test utility program has new command-line options
    -C, -D, -b and -R.
    Use -C one, two or three times to print information about the
    certificates received from a server, and information about the
    locally found and trusted issuer certificates, to diagnose
    server side configuration issues. It is possible to run tstclnt
    without providing a database (-D). A PKCS#11 library that
    contains root CA certificates can be loaded by tstclnt, which
    may either be the nssckbi library provided by NSS (-b) or
    another compatible library (-R).
  New Functions:
  * SEC_CheckCrlTimes
  * SEC_GetCrlTimes
  * SEC_PKCS12DecoderRenameCertNicknames
  New Types:
  * SEC_PKCS12NicknameRenameCallback
  Notable Changes:
  * The highest TLS protocol version enabled by default has been
    increased from TLS 1.0 to TLS 1.2. Similarly, the highest DTLS
    protocol version enabled by default has been increased from
    DTLS 1.0 to DTLS 1.2.
  * The default key size used by certutil when creating an RSA key
    pair has been increased from 1024 bits to 2048 bits.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=175
2015-04-03 08:58:03 +00:00
Wolfgang Rosenauer
7e56ae74c1 - update to 3.17.4
* Firefox target release 36
  Notable Changes:
  * bmo#1084986: If an SSL/TLS connection fails, because client and
                 server don't have any common protocol version enabled,
		 NSS has been changed to report error code
		 SSL_ERROR_UNSUPPORTED_VERSION (instead of reporting
		 SSL_ERROR_NO_CYPHER_OVERLAP).
  * bmo#1112461: libpkix was fixed to prefer the newest certificate,
                 if multiple certificates match.
  * bmo#1094492: fixed a memory corruption issue during failure of
                 keypair generation.
  * bmo#1113632: fixed a failure to reload a PKCS#11 module in FIPS
                 mode.
  * bmo#1119983: fixed interoperability of NSS server code with a
                 LibreSSL client.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=173
2015-01-31 18:08:08 +00:00
Wolfgang Rosenauer
f2d1031ce6 - update to 3.17.3
* Firefox target release 36
  New functionality:
  * Support for TLS_FALLBACK_SCSV has been added to the ssltap and
    tstclnt utilities
  Notable Changes:
  * The QuickDER decoder now decodes lengths robustly
    (CVE-2014-1569)
  * The following 1024-bit CA certificates were removed:
    - GTE CyberTrust Global Root
    - Thawte Server CA
    - Thawte Premium Server CA
    - America Online Root Certification Authority 1
    - America Online Root Certification Authority 2
  * The following CA certificates had the Websites and Code Signing
    trust bits turned off:
    - Class 3 Public Primary Certification Authority - G2
    - Equifax Secure eBusiness CA-1
  * The following CA certificates were added:
    - COMODO RSA Certification Authority
    - USERTrust RSA Certification Authority
    - USERTrust ECC Certification Authority
    - GlobalSign ECC Root CA - R4
    - GlobalSign ECC Root CA - R5
  * the version number of the updated root CA list has been set
    to 2.2

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=171
2014-12-27 12:24:22 +00:00
Wolfgang Rosenauer
99b3c1bb3c - update to 3.17.2
Bugfix release
  * bmo#1049435 - Importing an RSA private key fails if p < q
  * bmo#1057161 - NSS hangs with 100% CPU on invalid EC key
  * bmo#1078669 - certutil crashes when using the --certVersion parameter

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=169
2014-10-16 19:19:00 +00:00
Wolfgang Rosenauer
d2eba15b73 * MFSA 2014-73/CVE-2014-1568 (bmo#1064636, bmo#1069405)
RSA Signature Forgery in NSS

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=167
2014-09-24 19:29:06 +00:00