kpriv/pkgsrc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
pkgsrc/devel/nss/distinfo

24 lines
1.5 KiB
Text
Raw Normal View History

Update to 3.37.3 Changelog: No new functionality is introduced in these releases. The following compatibility fixes are included. Users are encouraged to upgrade. * Bug 1462303 - Connecting to a server that was recently upgraded to TLS 1.3 would result in a SSL_RX_MALFORMED_SERVER_HELLO error. * Bug 1460673 - Fix a rare bug with PKCS#12 files.
2018-06-07 21:04:59 +02:00
$NetBSD: distinfo,v 1.89 2018/06/07 19:04:59 ryoon Exp $
Update 3.13.4 * Change distfile to separated source. Changelog is not shown. Probably some bugs are fixed. Tested on NetBSD/i386 6.99.4 and DragonFly/i386 3.0.1.
2012-04-18 23:01:42 +02:00
Update to 3.37.3 Changelog: No new functionality is introduced in these releases. The following compatibility fixes are included. Users are encouraged to upgrade. * Bug 1462303 - Connecting to a server that was recently upgraded to TLS 1.3 would result in a SSL_RX_MALFORMED_SERVER_HELLO error. * Bug 1460673 - Fix a rare bug with PKCS#12 files.
2018-06-07 21:04:59 +02:00
SHA1 (nss-3.37.3.tar.gz) = 8bef50b806fee13da9133cd12c2608685c4ed916
RMD160 (nss-3.37.3.tar.gz) = 5881c09b9a5b36f066925ffe0009b7a85ab2e34b
SHA512 (nss-3.37.3.tar.gz) = 11b21818f9fcff11d0e7f4c066ae9fbce0052a30a6b30df9a20022792039b5348554834a472e1b1195e467b9902067f9719678d5ca32efb4e60f1df161feed6f
Size (nss-3.37.3.tar.gz) = 23034239 bytes
Update to 3.27 Changelog: The NSS team has released Network Security Services (NSS) 3.27, which is a minor release. Below is a summary of the changes. Please refer to the full release notes for additional details, including the SHA256 fingerprints of the changed CA certificates. New functionality: * Allow custom named group priorities for TLS key exchange handshake   (SSL_NamedGroupConfig). * Added support for RSA-PSS signatures in TLS 1.2 and TLS 1.3 New Functions: * SSL_NamedGroupConfig Notable Changes: * NPN can not be enabled anymore. * Hard limits on the maximum number of TLS records encrypted with the same    key are enforced. * Disabled renegotiation in DTLS. * The following CA certificates were Removed - CN = IGC/A, O = PM/SGDN, OU = DCSSI - CN = Juur-SK, O = AS Sertifitseerimiskeskus - CN = EBG Elektronik Sertifika Hizmet Sağlayıcısı - CN = S-TRUST Authentication and Encryption Root CA 2005:PN - O = VeriSign, Inc., OU = Class 1 Public Primary Certification Authority - O = VeriSign, Inc., OU = Class 2 Public Primary Certification Authority - G2 - O = VeriSign, Inc., OU = Class 3 Public Primary Certification Authority - O = Equifax, OU = Equifax Secure Certificate Authority - CN = Equifax Secure eBusiness CA-1 - CN = Equifax Secure Global eBusiness CA-1 The full release notes are available at https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.27_release_notes
2016-09-30 13:59:12 +02:00
SHA1 (patch-am) = bab47640c0d25629f43578e7b788859418b27ecd
Update to 3.15.1 Changelog: NSS 3.15.1 release notes Introduction Network Security Services (NSS) 3.15.1 is a patch release for NSS 3.15. The bug fixes in NSS 3.15.1 are described in the "Bugs Fixed" section below. Distribution Information NSS 3.15.1 source distributions are also available on ftp.mozilla.org for secure HTTPS download: Source tarballs: https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_15_1_RTM/src/ New in NSS 3.15.1 New Functionality TLS 1.2: TLS 1.2 (RFC 5246) is supported. HMAC-SHA256 cipher suites (RFC 5246 and RFC 5289) are supported, allowing TLS to be used without MD5 and SHA-1. Note the following limitations. The hash function used in the signature for TLS 1.2 client authentication must be the hash function of the TLS 1.2 PRF, which is always SHA-256 in NSS 3.15.1. AES GCM cipher suites are not yet supported. New Functions None. New Types in sslprot.h SSL_LIBRARY_VERSION_TLS_1_2 - The protocol version of TLS 1.2 on the wire, value 0x0303. TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_NULL_SHA256 - New TLS 1.2 only HMAC-SHA256 cipher suites. in sslerr.h SSL_ERROR_UNSUPPORTED_HASH_ALGORITHM, SSL_ERROR_DIGEST_FAILURE, SSL_ERROR_INCORRECT_SIGNATURE_ALGORITHM - New error codes for TLS 1.2. in sslt.h ssl_hmac_sha256 - A new value in the SSLMACAlgorithm enum type. ssl_signature_algorithms_xtn - A new value in the SSLExtensionType enum type. New PKCS #11 Mechanisms None. Notable Changes in NSS 3.15.1 Bug 856060 - Enforce name constraints on the common name in libpkix when no subjectAltName is present. Bug 875156 - Add const to the function arguments of SEC_CertNicknameConflict. Bug 877798 - Fix ssltap to print the certificate_status handshake message correctly. Bug 882829 - On Windows, NSS initialization fails if NSS cannot call the RtlGenRandom function. Bug 875601 - SECMOD_CloseUserDB/SECMOD_OpenUserDB fails to reset the token delay, leading to spurious failures. Bug 884072 - Fix a typo in the header include guard macro of secmod.h. Bug 876352 - certutil now warns if importing a PEM file that contains a private key. Bug 565296 - Fix the bug that shlibsign exited with status 0 even though it failed. The NSS_SURVIVE_DOUBLE_BYPASS_FAILURE build option is removed. Bugs fixed in NSS 3.15.1 https://bugzilla.mozilla.org/buglist.cgi?list_id=5689256;resolution=FIXED;classification=Components;query_format=advanced;target_milestone=3.15.1;product=NSS Compatibility NSS 3.15.1 shared libraries are backward compatible with all older NSS 3.x shared libraries. A program linked with older NSS 3.x shared libraries will work with NSS 3.15.1 shared libraries without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs to the functions listed in NSS Public Functions will remain compatible with future versions of the NSS shared libraries. NSS 3.15 release notes Introduction The NSS team has released Network Security Services (NSS) 3.15, which is a minor release. Distribution Information The HG tag is NSS_3_15_RTM. NSS 3.15 requires NSPR 4.10 or newer. NSS 3.15 source distributions are available on ftp.mozilla.org for secure HTTPS download: Source tarballs: https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_15_RTM/src/ New in NSS 3.15 New Functionality Support for OCSP Stapling (RFC 6066, Certificate Status Request) has been added for both client and server sockets. TLS client applications may enable this via a call to SSL_OptionSetDefault(SSL_ENABLE_OCSP_STAPLING, PR_TRUE); Added function SECITEM_ReallocItemV2. It replaces function SECITEM_ReallocItem, which is now declared as obsolete. Support for single-operation (eg: not multi-part) symmetric key encryption and decryption, via PK11_Encrypt and PK11_Decrypt. certutil has been updated to support creating name constraints extensions. New Functions in ssl.h SSL_PeerStapledOCSPResponse - Returns the server's stapled OCSP response, when used with a TLS client socket that negotiated the status_request extension. SSL_SetStapledOCSPResponses - Set's a stapled OCSP response for a TLS server socket to return when clients send the status_request extension. in ocsp.h CERT_PostOCSPRequest - Primarily intended for testing, permits the sending and receiving of raw OCSP request/responses. in secpkcs7.h SEC_PKCS7VerifyDetachedSignatureAtTime - Verifies a PKCS#7 signature at a specific time other than the present time. in xconst.h CERT_EncodeNameConstraintsExtension - Matching function for CERT_DecodeNameConstraintsExtension, added in NSS 3.10. in secitem.h SECITEM_AllocArray SECITEM_DupArray SECITEM_FreeArray SECITEM_ZfreeArray - Utility functions to handle the allocation and deallocation of SECItemArrays SECITEM_ReallocItemV2 - Replaces SECITEM_ReallocItem, which is now obsolete. SECITEM_ReallocItemV2 better matches caller expectations, in that it updates item->len on allocation. For more details of the issues with SECITEM_ReallocItem, see Bug 298649 and Bug 298938. in pk11pub.h PK11_Decrypt - Performs decryption as a single PKCS#11 operation (eg: not multi-part). This is necessary for AES-GCM. PK11_Encrypt - Performs encryption as a single PKCS#11 operation (eg: not multi-part). This is necessary for AES-GCM. New Types in secitem.h SECItemArray - Represents a variable-length array of SECItems. New Macros in ssl.h SSL_ENABLE_OCSP_STAPLING - Used with SSL_OptionSet to configure TLS client sockets to request the certificate_status extension (eg: OCSP stapling) when set to PR_TRUE Notable Changes in NSS 3.15 SECITEM_ReallocItem is now deprecated. Please consider using SECITEM_ReallocItemV2 in all future code. NSS has migrated from CVS to the Mercurial source control management system. Updated build instructions are available at Migration to HG As part of this migration, the source code directory layout has been re-organized. The list of root CA certificates in the nssckbi module has been updated. The default implementation of SSL_AuthCertificate has been updated to add certificate status responses stapled by the TLS server to the OCSP cache. Applications that use SSL_AuthCertificateHook to override the default handler should add appropriate calls to SSL_PeerStapledOCSPResponse and CERT_CacheOCSPResponseFromSideChannel. Bug 554369: Fixed correctness of CERT_CacheOCSPResponseFromSideChannel and other OCSP caching behaviour. Bug 853285: Fixed bugs in AES GCM. Bug 341127: Fix the invalid read in rc4_wordconv. Faster NIST curve P-256 implementation. Dropped (32-bit) SPARC V8 processor support on Solaris. The shared library libfreebl_32int_3.so is no longer produced. Bugs fixed in NSS 3.15 This Bugzilla query returns all the bugs fixed in NSS 3.15: https://bugzilla.mozilla.org/buglist.cgi?list_id=6278317&resolution=FIXED&classification=Components&query_format=advanced&product=NSS&target_milestone=3.15
2013-07-20 11:28:11 +02:00
SHA1 (patch-an) = 4ab22f2a575676b5b640bc9a760b83eb05c75e69
nss: Fix build on SunOS with clang.
2018-01-22 12:43:14 +01:00
SHA1 (patch-md) = 8547c9414332c02221b96719dea1e09cb741f4d1
SHA1 (patch-me) = 9da633e494c8656f22162b354d9710a770d24345
Update to 3.23 Changelog: The NSS team has released Network Security Services (NSS) 3.23, which is a minor release. The following security-relevant bug has been resolved in NSS 3.23. Users are encouraged to upgrade immediately. * Bug 1245528 (CVE-2016-1950): Fixed a heap-based buffer overflow related to the parsing of certain ASN.1 structures. An attacker could create a specially-crafted certificate which, when parsed by NSS, would cause a crash or execution of arbitrary code with the permissions of the user. New functionality: * ChaCha20/Poly1305 cipher and TLS cipher suites now supported (bug 917571, bug 1227905) * Experimental-only support TLS 1.3 1-RTT mode (draft-11). This code is not ready for production use. New Functions: * SSL_SetDowngradeCheckVersion - Set maximum version for new ServerRandom anti-downgrade mechanism Notable Changes: * The copy of SQLite shipped with NSS has been updated to version 3.10.2 (bug 1234698) * The list of TLS extensions sent in the TLS handshake has been reordered to improve compatibility of the Extended Master Secret feature with servers (bug 1243641) * The build time environment variable NSS_ENABLE_ZLIB has been renamed to NSS_SSL_ENABLE_ZLIB (Bug 1243872). * The build time environment variable NSS_DISABLE_CHACHAPOLY was added, which can be used to prevent compilation of the ChaCha20/Poly1305 code. * The following CA certificates were Removed - Staat der Nederlanden Root CA - NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado - NetLock Kozjegyzoi (Class A) Tanusitvanykiado - NetLock Uzleti (Class B) Tanusitvanykiado - NetLock Expressz (Class C) Tanusitvanykiado - VeriSign Class 1 Public PCA – G2 - VeriSign Class 3 Public PCA - VeriSign Class 3 Public PCA – G2 - CA Disig * The following CA certificates were Added - SZAFIR ROOT CA2 - Certum Trusted Network CA 2 * The following CA certificate had the Email trust bit turned on - Actalis Authentication Root CA The full release notes, including the SHA256 fingerprints of the changed CA certificates, are available at https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.23_release_notes
2016-04-17 21:27:10 +02:00
SHA1 (patch-mf) = 534fe5f711f60dadc3432bc805a6153535f11709
Update to 3.15.1 Changelog: NSS 3.15.1 release notes Introduction Network Security Services (NSS) 3.15.1 is a patch release for NSS 3.15. The bug fixes in NSS 3.15.1 are described in the "Bugs Fixed" section below. Distribution Information NSS 3.15.1 source distributions are also available on ftp.mozilla.org for secure HTTPS download: Source tarballs: https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_15_1_RTM/src/ New in NSS 3.15.1 New Functionality TLS 1.2: TLS 1.2 (RFC 5246) is supported. HMAC-SHA256 cipher suites (RFC 5246 and RFC 5289) are supported, allowing TLS to be used without MD5 and SHA-1. Note the following limitations. The hash function used in the signature for TLS 1.2 client authentication must be the hash function of the TLS 1.2 PRF, which is always SHA-256 in NSS 3.15.1. AES GCM cipher suites are not yet supported. New Functions None. New Types in sslprot.h SSL_LIBRARY_VERSION_TLS_1_2 - The protocol version of TLS 1.2 on the wire, value 0x0303. TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_NULL_SHA256 - New TLS 1.2 only HMAC-SHA256 cipher suites. in sslerr.h SSL_ERROR_UNSUPPORTED_HASH_ALGORITHM, SSL_ERROR_DIGEST_FAILURE, SSL_ERROR_INCORRECT_SIGNATURE_ALGORITHM - New error codes for TLS 1.2. in sslt.h ssl_hmac_sha256 - A new value in the SSLMACAlgorithm enum type. ssl_signature_algorithms_xtn - A new value in the SSLExtensionType enum type. New PKCS #11 Mechanisms None. Notable Changes in NSS 3.15.1 Bug 856060 - Enforce name constraints on the common name in libpkix when no subjectAltName is present. Bug 875156 - Add const to the function arguments of SEC_CertNicknameConflict. Bug 877798 - Fix ssltap to print the certificate_status handshake message correctly. Bug 882829 - On Windows, NSS initialization fails if NSS cannot call the RtlGenRandom function. Bug 875601 - SECMOD_CloseUserDB/SECMOD_OpenUserDB fails to reset the token delay, leading to spurious failures. Bug 884072 - Fix a typo in the header include guard macro of secmod.h. Bug 876352 - certutil now warns if importing a PEM file that contains a private key. Bug 565296 - Fix the bug that shlibsign exited with status 0 even though it failed. The NSS_SURVIVE_DOUBLE_BYPASS_FAILURE build option is removed. Bugs fixed in NSS 3.15.1 https://bugzilla.mozilla.org/buglist.cgi?list_id=5689256;resolution=FIXED;classification=Components;query_format=advanced;target_milestone=3.15.1;product=NSS Compatibility NSS 3.15.1 shared libraries are backward compatible with all older NSS 3.x shared libraries. A program linked with older NSS 3.x shared libraries will work with NSS 3.15.1 shared libraries without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs to the functions listed in NSS Public Functions will remain compatible with future versions of the NSS shared libraries. NSS 3.15 release notes Introduction The NSS team has released Network Security Services (NSS) 3.15, which is a minor release. Distribution Information The HG tag is NSS_3_15_RTM. NSS 3.15 requires NSPR 4.10 or newer. NSS 3.15 source distributions are available on ftp.mozilla.org for secure HTTPS download: Source tarballs: https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_15_RTM/src/ New in NSS 3.15 New Functionality Support for OCSP Stapling (RFC 6066, Certificate Status Request) has been added for both client and server sockets. TLS client applications may enable this via a call to SSL_OptionSetDefault(SSL_ENABLE_OCSP_STAPLING, PR_TRUE); Added function SECITEM_ReallocItemV2. It replaces function SECITEM_ReallocItem, which is now declared as obsolete. Support for single-operation (eg: not multi-part) symmetric key encryption and decryption, via PK11_Encrypt and PK11_Decrypt. certutil has been updated to support creating name constraints extensions. New Functions in ssl.h SSL_PeerStapledOCSPResponse - Returns the server's stapled OCSP response, when used with a TLS client socket that negotiated the status_request extension. SSL_SetStapledOCSPResponses - Set's a stapled OCSP response for a TLS server socket to return when clients send the status_request extension. in ocsp.h CERT_PostOCSPRequest - Primarily intended for testing, permits the sending and receiving of raw OCSP request/responses. in secpkcs7.h SEC_PKCS7VerifyDetachedSignatureAtTime - Verifies a PKCS#7 signature at a specific time other than the present time. in xconst.h CERT_EncodeNameConstraintsExtension - Matching function for CERT_DecodeNameConstraintsExtension, added in NSS 3.10. in secitem.h SECITEM_AllocArray SECITEM_DupArray SECITEM_FreeArray SECITEM_ZfreeArray - Utility functions to handle the allocation and deallocation of SECItemArrays SECITEM_ReallocItemV2 - Replaces SECITEM_ReallocItem, which is now obsolete. SECITEM_ReallocItemV2 better matches caller expectations, in that it updates item->len on allocation. For more details of the issues with SECITEM_ReallocItem, see Bug 298649 and Bug 298938. in pk11pub.h PK11_Decrypt - Performs decryption as a single PKCS#11 operation (eg: not multi-part). This is necessary for AES-GCM. PK11_Encrypt - Performs encryption as a single PKCS#11 operation (eg: not multi-part). This is necessary for AES-GCM. New Types in secitem.h SECItemArray - Represents a variable-length array of SECItems. New Macros in ssl.h SSL_ENABLE_OCSP_STAPLING - Used with SSL_OptionSet to configure TLS client sockets to request the certificate_status extension (eg: OCSP stapling) when set to PR_TRUE Notable Changes in NSS 3.15 SECITEM_ReallocItem is now deprecated. Please consider using SECITEM_ReallocItemV2 in all future code. NSS has migrated from CVS to the Mercurial source control management system. Updated build instructions are available at Migration to HG As part of this migration, the source code directory layout has been re-organized. The list of root CA certificates in the nssckbi module has been updated. The default implementation of SSL_AuthCertificate has been updated to add certificate status responses stapled by the TLS server to the OCSP cache. Applications that use SSL_AuthCertificateHook to override the default handler should add appropriate calls to SSL_PeerStapledOCSPResponse and CERT_CacheOCSPResponseFromSideChannel. Bug 554369: Fixed correctness of CERT_CacheOCSPResponseFromSideChannel and other OCSP caching behaviour. Bug 853285: Fixed bugs in AES GCM. Bug 341127: Fix the invalid read in rc4_wordconv. Faster NIST curve P-256 implementation. Dropped (32-bit) SPARC V8 processor support on Solaris. The shared library libfreebl_32int_3.so is no longer produced. Bugs fixed in NSS 3.15 This Bugzilla query returns all the bugs fixed in NSS 3.15: https://bugzilla.mozilla.org/buglist.cgi?list_id=6278317&resolution=FIXED&classification=Components&query_format=advanced&product=NSS&target_milestone=3.15
2013-07-20 11:28:11 +02:00
SHA1 (patch-mg) = 3c878548c98bdea559a3e653e63e0ed22a2a8834
SHA1 (patch-mh) = a46d3098a85c3a4a57895a9845bc1741fc5e9561
SHA1 (patch-mj) = 08ca1a37afce99e0292a20348fc6855547f44e8a
Update to 3.19 Changelog: The NSS team has released Network Security Services (NSS) 3.19, which is a minor release. New functionality: * For some certificates, such as root CA certificates, that don't embed any constraints, NSS might impose additional constraints, such as name constraints. A new API has been added that allows to lookup imposed constraints. * It is possible to override the directory in which the NSS build system will look for the sqlite library. New Functions: * CERT_GetImposedNameConstraints Notable Changes: * The SSL 3 protocol has been disabled by default. * NSS now more strictly validates TLS extensions and will fail a handshake that contains malformed extensions. * Fixed a bug related to the ordering of TLS handshake messages. * In TLS 1.2 handshakes, NSS advertises support for the SHA512 hash algorithm, in order to be compatible with TLS servers that use certificates with a SHA512 signature.
2015-05-05 23:42:19 +02:00
SHA1 (patch-mn) = 5b79783e48249044be1a904a6cfd20ba175b5fd4
SHA1 (patch-nss_cmd_platlibs.mk) = 7dadcb72acf15714c61ae74b21c5baf45bc51d4c
Update to 3.24 * Require nspr 4.12 or later, from he@. Thank you. Changelog: The NSS team has released Network Security Services (NSS) 3.24, which is a minor release. Below is a short summary of the changes. Please refer to the full release notes for additional details. New functionality: * NSS softoken has been updated with the latest NIST guidance (as of 2015) * NSS softoken has also been updated to allow NSS to run in FIPS level-1 (no password). * SSL_ConfigServerCert function has been added for configuring SSL/TLS server sockets with a certificate and private key. This method should be used in preference to SSL_ConfigSecureServer, SSL_ConfigSecureServerWithCertChain, SSL_SetStapledOCSPResponses, and SSL_SetSignedCertTimestamps. * Added PORTCheapArena for temporary arenas allocated on the stack. New Functions: * SSL_ConfigServerCert - Configures an SSL/TLS socket with a certificate, private key and other information. * PORT_InitCheapArena - This initializes an arena that was created on the stack. See PORTCheapArenaPool. * PORT_DestroyCheapArena - This destroys an arena that was created on the stack. See PORTCheapArenaPool. New Types * SSLExtraServerCertData - This struct is optionally passed as an argument to SSL_ConfigServerCert. It contains supplementary information about a certificate, such as the intended type of the certificate, stapled OCSP responses, or signed certificate timestamps (used for certificate transparency). * PORTCheapArenaPool - A stack-allocated arena pool, to be used for temporary arena allocations. New Macros * CKM_TLS12_MAC * SEC_OID_TLS_ECDHE_PSK - This OID is used to govern use of the TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 cipher suite, which is only used for session resumption in TLS 1.3. Notable Changes: * The following functions have been deprecated (applications should use the new SSL_ConfigServerCert function instead): * SSL_SetStapledOCSPResponses * SSL_SetSignedCertTimestamps * SSL_ConfigSecureServer * SSL_ConfigSecureServerWithCertChain * Function NSS_FindCertKEAType is now deprecated, as it reports a misleading value for certificates that might be used for signing rather than key exchange. * SSLAuthType has been updated to define a larger number of authentication key types. * The member attribute authAlgorithm of type SSLCipherSuiteInfo has been deprecated. Instead, applications should use the newly added attribute authType. * ssl_auth_rsa has been renamed to ssl_auth_rsa_decrypt. * On Linux platforms that define FREEBL_LOWHASH, a shared library has been added: libfreeblpriv3 * Most code related to the SSL v2 has been removed, including the ability to actively send a SSL v2 compatible client hello. However, the server side implementation of the SSL/TLS protocol continues to support processing of received v2 compatible client hello messages. * NSS supports a mechanism to log SSL/TLS key material to a logfile if the environment variable named SSLKEYLOGFILE is set. NSS has been changed to disable this functionality in optimized builds by default. In order to enable the functionality in optimized builds, the symbol NSS_ALLOW_SSLKEYLOGFILE must be defined when building NSS. * NSS has been updated to be protected against the Cachebleed attack. * Support for DTLS compression has been disabled. * Support for TLS 1.3 has been improved. This includes support for DTLS 1.3. Note that TLS 1.3 support is experimental and is not suitable for production use.
2016-05-25 15:17:13 +02:00
SHA1 (patch-nss_coreconf_OpenBSD.mk) = fccc17845c28f5b1268c96eb4e952e32dd530d1d
Update to 3.27 Changelog: The NSS team has released Network Security Services (NSS) 3.27, which is a minor release. Below is a summary of the changes. Please refer to the full release notes for additional details, including the SHA256 fingerprints of the changed CA certificates. New functionality: * Allow custom named group priorities for TLS key exchange handshake   (SSL_NamedGroupConfig). * Added support for RSA-PSS signatures in TLS 1.2 and TLS 1.3 New Functions: * SSL_NamedGroupConfig Notable Changes: * NPN can not be enabled anymore. * Hard limits on the maximum number of TLS records encrypted with the same    key are enforced. * Disabled renegotiation in DTLS. * The following CA certificates were Removed - CN = IGC/A, O = PM/SGDN, OU = DCSSI - CN = Juur-SK, O = AS Sertifitseerimiskeskus - CN = EBG Elektronik Sertifika Hizmet Sağlayıcısı - CN = S-TRUST Authentication and Encryption Root CA 2005:PN - O = VeriSign, Inc., OU = Class 1 Public Primary Certification Authority - O = VeriSign, Inc., OU = Class 2 Public Primary Certification Authority - G2 - O = VeriSign, Inc., OU = Class 3 Public Primary Certification Authority - O = Equifax, OU = Equifax Secure Certificate Authority - CN = Equifax Secure eBusiness CA-1 - CN = Equifax Secure Global eBusiness CA-1 The full release notes are available at https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.27_release_notes
2016-09-30 13:59:12 +02:00
SHA1 (patch-nss_coreconf_command.mk) = 008f7670f164bf19555a7691f5a59fc8bf687078
Ajust patch for 3.36.1
2018-04-12 16:32:51 +02:00
SHA1 (patch-nss_lib_freebl_blinit.c) = 94e2c7d64ae04bf2c18d3c4071cb6458536e4e3e
Change default file type back to DBM from SQL. Bump PKGREVISION This back out fixes XML-based files open of misc/libreoffice. The problem is reported by Mustafa Dogan via private e-mail.
2018-02-24 12:35:48 +01:00
SHA1 (patch-nss_lib_util_utilpars.c) = 5d3000515b01037929730a752b7d7a0f46f06deb
SHA1 (patch-nss_tests_all.sh) = f8d0fcfcd67dca757c9ce016660210b20b1e6e8f
SHA1 (patch-nss_tests_merge_merge.sh) = 42a4866d226b1076740ba9a5e42c7604f2cb15a7
Update to 3.15.1 Changelog: NSS 3.15.1 release notes Introduction Network Security Services (NSS) 3.15.1 is a patch release for NSS 3.15. The bug fixes in NSS 3.15.1 are described in the "Bugs Fixed" section below. Distribution Information NSS 3.15.1 source distributions are also available on ftp.mozilla.org for secure HTTPS download: Source tarballs: https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_15_1_RTM/src/ New in NSS 3.15.1 New Functionality TLS 1.2: TLS 1.2 (RFC 5246) is supported. HMAC-SHA256 cipher suites (RFC 5246 and RFC 5289) are supported, allowing TLS to be used without MD5 and SHA-1. Note the following limitations. The hash function used in the signature for TLS 1.2 client authentication must be the hash function of the TLS 1.2 PRF, which is always SHA-256 in NSS 3.15.1. AES GCM cipher suites are not yet supported. New Functions None. New Types in sslprot.h SSL_LIBRARY_VERSION_TLS_1_2 - The protocol version of TLS 1.2 on the wire, value 0x0303. TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_NULL_SHA256 - New TLS 1.2 only HMAC-SHA256 cipher suites. in sslerr.h SSL_ERROR_UNSUPPORTED_HASH_ALGORITHM, SSL_ERROR_DIGEST_FAILURE, SSL_ERROR_INCORRECT_SIGNATURE_ALGORITHM - New error codes for TLS 1.2. in sslt.h ssl_hmac_sha256 - A new value in the SSLMACAlgorithm enum type. ssl_signature_algorithms_xtn - A new value in the SSLExtensionType enum type. New PKCS #11 Mechanisms None. Notable Changes in NSS 3.15.1 Bug 856060 - Enforce name constraints on the common name in libpkix when no subjectAltName is present. Bug 875156 - Add const to the function arguments of SEC_CertNicknameConflict. Bug 877798 - Fix ssltap to print the certificate_status handshake message correctly. Bug 882829 - On Windows, NSS initialization fails if NSS cannot call the RtlGenRandom function. Bug 875601 - SECMOD_CloseUserDB/SECMOD_OpenUserDB fails to reset the token delay, leading to spurious failures. Bug 884072 - Fix a typo in the header include guard macro of secmod.h. Bug 876352 - certutil now warns if importing a PEM file that contains a private key. Bug 565296 - Fix the bug that shlibsign exited with status 0 even though it failed. The NSS_SURVIVE_DOUBLE_BYPASS_FAILURE build option is removed. Bugs fixed in NSS 3.15.1 https://bugzilla.mozilla.org/buglist.cgi?list_id=5689256;resolution=FIXED;classification=Components;query_format=advanced;target_milestone=3.15.1;product=NSS Compatibility NSS 3.15.1 shared libraries are backward compatible with all older NSS 3.x shared libraries. A program linked with older NSS 3.x shared libraries will work with NSS 3.15.1 shared libraries without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs to the functions listed in NSS Public Functions will remain compatible with future versions of the NSS shared libraries. NSS 3.15 release notes Introduction The NSS team has released Network Security Services (NSS) 3.15, which is a minor release. Distribution Information The HG tag is NSS_3_15_RTM. NSS 3.15 requires NSPR 4.10 or newer. NSS 3.15 source distributions are available on ftp.mozilla.org for secure HTTPS download: Source tarballs: https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_15_RTM/src/ New in NSS 3.15 New Functionality Support for OCSP Stapling (RFC 6066, Certificate Status Request) has been added for both client and server sockets. TLS client applications may enable this via a call to SSL_OptionSetDefault(SSL_ENABLE_OCSP_STAPLING, PR_TRUE); Added function SECITEM_ReallocItemV2. It replaces function SECITEM_ReallocItem, which is now declared as obsolete. Support for single-operation (eg: not multi-part) symmetric key encryption and decryption, via PK11_Encrypt and PK11_Decrypt. certutil has been updated to support creating name constraints extensions. New Functions in ssl.h SSL_PeerStapledOCSPResponse - Returns the server's stapled OCSP response, when used with a TLS client socket that negotiated the status_request extension. SSL_SetStapledOCSPResponses - Set's a stapled OCSP response for a TLS server socket to return when clients send the status_request extension. in ocsp.h CERT_PostOCSPRequest - Primarily intended for testing, permits the sending and receiving of raw OCSP request/responses. in secpkcs7.h SEC_PKCS7VerifyDetachedSignatureAtTime - Verifies a PKCS#7 signature at a specific time other than the present time. in xconst.h CERT_EncodeNameConstraintsExtension - Matching function for CERT_DecodeNameConstraintsExtension, added in NSS 3.10. in secitem.h SECITEM_AllocArray SECITEM_DupArray SECITEM_FreeArray SECITEM_ZfreeArray - Utility functions to handle the allocation and deallocation of SECItemArrays SECITEM_ReallocItemV2 - Replaces SECITEM_ReallocItem, which is now obsolete. SECITEM_ReallocItemV2 better matches caller expectations, in that it updates item->len on allocation. For more details of the issues with SECITEM_ReallocItem, see Bug 298649 and Bug 298938. in pk11pub.h PK11_Decrypt - Performs decryption as a single PKCS#11 operation (eg: not multi-part). This is necessary for AES-GCM. PK11_Encrypt - Performs encryption as a single PKCS#11 operation (eg: not multi-part). This is necessary for AES-GCM. New Types in secitem.h SECItemArray - Represents a variable-length array of SECItems. New Macros in ssl.h SSL_ENABLE_OCSP_STAPLING - Used with SSL_OptionSet to configure TLS client sockets to request the certificate_status extension (eg: OCSP stapling) when set to PR_TRUE Notable Changes in NSS 3.15 SECITEM_ReallocItem is now deprecated. Please consider using SECITEM_ReallocItemV2 in all future code. NSS has migrated from CVS to the Mercurial source control management system. Updated build instructions are available at Migration to HG As part of this migration, the source code directory layout has been re-organized. The list of root CA certificates in the nssckbi module has been updated. The default implementation of SSL_AuthCertificate has been updated to add certificate status responses stapled by the TLS server to the OCSP cache. Applications that use SSL_AuthCertificateHook to override the default handler should add appropriate calls to SSL_PeerStapledOCSPResponse and CERT_CacheOCSPResponseFromSideChannel. Bug 554369: Fixed correctness of CERT_CacheOCSPResponseFromSideChannel and other OCSP caching behaviour. Bug 853285: Fixed bugs in AES GCM. Bug 341127: Fix the invalid read in rc4_wordconv. Faster NIST curve P-256 implementation. Dropped (32-bit) SPARC V8 processor support on Solaris. The shared library libfreebl_32int_3.so is no longer produced. Bugs fixed in NSS 3.15 This Bugzilla query returns all the bugs fixed in NSS 3.15: https://bugzilla.mozilla.org/buglist.cgi?list_id=6278317&resolution=FIXED&classification=Components&query_format=advanced&product=NSS&target_milestone=3.15
2013-07-20 11:28:11 +02:00
SHA1 (patch-security_nss_cmd_shlibsign_sign.sh) = 7948b7b502a4c148ee185836dde8a84d3aa388af
Reference in a new issue Copy permalink