1466028 - Upgrade Firefox 60 ESR to use NSS 3.36.4

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement)

Description

[Franziskus Kiefer [:franziskus]]

Because of bug 1461731 a new NSS release (3.36.3) for uplift to Firefox 60 ESR was requested.

This release includes fixes for
* bug 1461731 
* bug 1459739

If there's a Firefox 60 dot release, this should be taken as well.

Comment 1

[Julien Cristau [:jcristau]]

Is there an ETA for the NSS_3_36_3_RTM tag?

Comment 2

[Franziskus Kiefer [:franziskus]]

The fix for bug 1461731 landed in central two day ago. Since nothing is burning and there are no other bugs to take along we can start creating the release.
When do you need it?

Comment 3

[Franziskus Kiefer [:franziskus]]

Bug 1459739 is actually a regression in 3.37 and doesn't need fixing here. So this is only bug 1461731.

Comment 4

[Julien Cristau [:jcristau]]

We might have to build 60.0.2 for bug 1460223 so today/tomorrow would be great if we want to include this fix.

Comment 5

[Franziskus Kiefer [:franziskus]]

Attachment: upgrade-nss

[Approval Request Comment]
If this is not a sec:{high,crit} bug, please state case for ESR consideration: There's a high number of crashes related to bug 1461731.
User impact if declined: Firefox will crash on macOS when WebAuthn or PK11 tokens are used.
Fix Landed on Version: NSS 3.38/Fx62
Risk to taking this patch (and alternatives if risky): Low risk. The code change is minimal.
String or UUID changes made by this patch: none

Comment 6

[Liz Henry (:lizzard) (relman/hg->git project)]

Franziskus would this also apply for 60.0.2 release? Or only for ESR?

Comment 7

[Franziskus Kiefer [:franziskus]]

Originally this was only intended for the ESR release but it should ride along if there is a 60 dot release. I'll attach approval request for 60.0.2 as well in case someone wants to take it.

Comment 8

[Franziskus Kiefer [:franziskus]]

Attachment: upgrade-nss 60.0.2

Approval Request Comment
[Feature/Bug causing the regression]: This fixes three NSS issues: bug 1462303, bug 1460673, bug 1461731, and bug 1459739.
[User impact if declined]: macOS can crash on WebAuthn or PK11 operations; TLS 1.3 can fail
[Is this code covered by automated tests?]: only in NSS
[Has the fix been verified in Nightly?]: yes, bug 1462303, bug 1460673 have been in nightly, beta, and ESR for a while. bug 1461731 and bug 1459739 have been in nightly for a couple days as well.
[Needs manual test from QE? If yes, steps to reproduce]: no.
[List of other uplifts needed for the feature/fix]: -
[Is the change risky?]: No.
[Why is the change risky/not risky?]: The code changes are small and have been tested on other Firefox branches.
[String changes made/needed]: -

Comment 9

[Franziskus Kiefer [:franziskus]]

Attachment: upgrade-nss

Sorry I messed up version numbers.

[Approval Request Comment]
If this is not a sec:{high,crit} bug, please state case for ESR consideration: There's a high number of crashes related to bug 1461731.
User impact if declined: Firefox will crash on macOS when WebAuthn or PK11 tokens are used.
Fix Landed on Version: NSS 3.38/Fx62
Risk to taking this patch (and alternatives if risky): Low risk. The code change is minimal.
String or UUID changes made by this patch: none

Comment 10

[Franziskus Kiefer [:franziskus]]

Attachment: upgrade-nss 60.0.2

Sorry, messed up version numbers.

Approval Request Comment
[Feature/Bug causing the regression]: This fixes three NSS issues: bug 1462303, bug 1460673, bug 1461731, and bug 1459739.
[User impact if declined]: macOS can crash on WebAuthn or PK11 operations; TLS 1.3 can fail
[Is this code covered by automated tests?]: only in NSS
[Has the fix been verified in Nightly?]: yes, bug 1462303, bug 1460673 have been in nightly, beta, and ESR for a while. bug 1461731 and bug 1459739 have been in nightly for a couple days as well.
[Needs manual test from QE? If yes, steps to reproduce]: no.
[List of other uplifts needed for the feature/fix]: -
[Is the change risky?]: No.
[Why is the change risky/not risky?]: The code changes are small and have been tested on other Firefox branches.
[String changes made/needed]: -

Comment 11

[Julien Cristau [:jcristau]]

Comment on attachment 8983344 [details]
upgrade-nss 60.0.2

I'll take this for 60.0.2.

Comment 12

[Julien Cristau [:jcristau]]

https://hg.mozilla.org/releases/mozilla-release/rev/b5ad20486d35

Comment 13

[Julien Cristau [:jcristau]]

https://hg.mozilla.org/releases/mozilla-esr60/rev/09a3df50c0f6 (FIREFOX_ESR_60_0_X_RELBRANCH)

Comment 14

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 8983343 [details]
upgrade-nss

Approved for ESR 60.1 as well.

Comment 15

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr60/rev/25a710304ebb (default)