1566873 - Upgrade Firefox ESR 68 to use NSS 3.44.2

Status: RESOLVED FIXED

(Core :: Security: PSM, task, P1)

Description

[J.C. Jones [:jcj] (he/they)]

[Tracking Requested - why for this release]:

This is a cumulative security update for NSS 3.44 for Firefox 68 ESR. When ready, the tag will be NSS_3_44_2_RTM.

Comment 1

[J.C. Jones [:jcj] (he/they)]

At this point, we do not have a 3.44.2 release.

Comment 2

[J.C. Jones [:jcj] (he/they)]

[Tracking Requested - why for this release]:
Re-opening to handle a sec-high which will eventually warrant ESR uplift and a 3.44.2 release.

Note that we may want to add some follow-on security fixes, TBD.

Comment 3

[J.C. Jones [:jcj] (he/they)]

We're proposing releasing this on 9 October, same as bug 1581998. Is that an OK date, too?

Comment 4

[Ryan VanderMeulen [:RyanVM][PTO June 24-28]]

SGTM

Comment 5

[J.C. Jones [:jcj] (he/they)]

Update: Per bug 1581998 we're now looking at the releases and uplifts being Wednesday, 2 October.

Comment 6

[J.C. Jones [:jcj] (he/they)]

Attachment: Bug 1566873 - land NSS NSS_3_44_2_RTM UPGRADE_NSS_RELEASE, r=kjacobs

2019-10-02 J.C. Jones <[e-mail]>

* lib/nss/nss.h, lib/softoken/softkver.h, lib/util/nssutil.h:
Set version numbers to 3.44.2 final
[927b49b0d5cf] [NSS_3_44_2_RTM] <NSS_3_44_BRANCH>

2019-10-01 Kevin Jacobs <[e-mail]>

* lib/softoken/pkcs11c.c:
Bug 1577953 - Support longer (up to RFC maximum) HKDF outputs r=jcj

HKDF-Expand enforces a maximum output length much shorter than
stated in the RFC. This patch aligns the implementation with the RFC
by allocating more output space when necessary.

[03b50c2194ae] <NSS_3_44_BRANCH>

2019-09-26 Deian Stefan <[e-mail]>

* lib/softoken/pkcs11c.c, lib/softoken/tlsprf.c:
Bug 1582343 - Use constant time memcmp in more places r=kjacobs,jcj
[2c2f4c87b7cf] <NSS_3_44_BRANCH>

2019-05-15 Kevin Jacobs <[e-mail]>

* automation/taskcluster/graph/src/extend.js:
Bug 1551636 - Apply increased chains test timeout to Win32 in
addition to Win64 r=jcj

[189819ec6093] <NSS_3_44_BRANCH>

2019-06-21 J.C. Jones <[e-mail]>

* .hgtags:
Added tag NSS_3_44_1_RTM for changeset ca5ab596cbe7
[9a8eb3bb9b81] <NSS_3_44_BRANCH>

Comment 7

[J.C. Jones [:jcj] (he/they)]

Comment on attachment 9098393 [details]
Bug 1566873 - land NSS NSS_3_44_2_RTM UPGRADE_NSS_RELEASE, r=kjacobs

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration:
• User impact if declined: One sec-high, one sec-audit.
• Fix Landed on Version: 71
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The functionality fixes are straightforward and limited to specific crypto operaitons' correctness.
• String or UUID changes made by this patch: None

Comment 8

[Ryan VanderMeulen [:RyanVM][PTO June 24-28]]

Comment on attachment 9098393 [details]
Bug 1566873 - land NSS NSS_3_44_2_RTM UPGRADE_NSS_RELEASE, r=kjacobs

Updates NSS to pick up some security fixes. Approved for 68.2esr.

Comment 9

[Ryan VanderMeulen [:RyanVM][PTO June 24-28]]

https://hg.mozilla.org/releases/mozilla-esr68/rev/3f93b68ba391