Summary
nspr
[4.25.0-2]
- Rebuild to fix wrong dist tag
[4.25.0-1]
- Rebase to NSPR 4.25
nss
[3.53.1-3]
- Disable dh timing test because it's unreliable on s390 (from Bob Relyea)
- Explicitly enable upgradedb/sharedb test cycles
[3.53.1-2]
- Disable TLS 1.3 by default
[3.53.1-1]
- Rebase to NSS 3.53.1
[3.44.0-8]
- Increase timeout on ssl_gtest so that slow platforms can complete when
running on a busy system.
nss-softokn
[3.53.1-6.0.1]
- Add fips140-2 DSA Known Answer Test fix [Orabug: 26679337]
- Add fips140-2 ECDSA/RSA/DSA Pairwise Consistency Test fix [Orabug: 26617814],
[Orabug: 26617879], [Orabug: 26617849]
[3.53.1-6]
- turn of ALTIVEC instruction for powerpc because they require
power8 and we need to support power7 on RHEL7 still.
- Fix typo in measure.
- Make sure only 2048 and greater primes are used in FIPS mode
for dh.
[3.53.1-5]
- Fix the patch application in the previous change
[3.53.1-4]
- Fix glibc regression in the rebase; run RNG self-tests only if NSPR is linked
[3.53.1-3]
- include patches for CVE-2020-6829, CVE-2020-12400,
and CVE-2020-12401 from upstream (ECC constant time issues).
- include patches for CVE-2020-12403 from upstream
(CHACHA issues).
- include self-tests for kdfs and cmac.
[3.53.1-2]
- Install cmac.h required by blapi.h (#1764513)
[3.53.1-1]
- Rebase to NSS 3.53.1
nss-util
[3.53.1-1]
- Rebase to NSS 3.53.1
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | nspr | 0:4.25.0-2.el7_9 |
| Oracle Linux · 7 | nspr-devel | 0:4.25.0-2.el7_9 |
| Oracle Linux · 7 | nss | 0:3.53.1-3.el7_9 |
| Oracle Linux · 7 | nss-devel | 0:3.53.1-3.el7_9 |
| Oracle Linux · 7 | nss-pkcs11-devel | 0:3.53.1-3.el7_9 |
| Oracle Linux · 7 | nss-softokn | 0:3.53.1-6.0.1.el7_9 |
| Oracle Linux · 7 | nss-softokn-devel | 0:3.53.1-6.0.1.el7_9 |
| Oracle Linux · 7 | nss-softokn-freebl | 0:3.53.1-6.0.1.el7_9 |
| Oracle Linux · 7 | nss-softokn-freebl-devel | 0:3.53.1-6.0.1.el7_9 |
| Oracle Linux · 7 | nss-sysinit | 0:3.53.1-3.el7_9 |
| Oracle Linux · 7 | nss-tools | 0:3.53.1-3.el7_9 |
| Oracle Linux · 7 | nss-util | 0:3.53.1-1.el7_9 |
| Oracle Linux · 7 | nss-util-devel | 0:3.53.1-1.el7_9 |
Vulnerabilities 10
-
Unscored —
When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bo…
-
Unscored —
A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1…
-
Unscored —
Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial o…
-
Unscored —
In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases wh…
-
Unscored —
After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invali…
-
Unscored —
When converting coordinates from projective to affine, the modular inversion was not performed in constant time, result…
-
Unscored —
During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication …
-
Unscored —
During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which ent…
-
Unscored —
A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Cha…
-
Unscored —
When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial …