1632908 - Upgrade Firefox ESR 68.9 to NSS 3.44.4

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P1)

Description

[J.C. Jones [:jcj] (he/him)]

This security bug tracks the release of NSS 3.44.4, an extended support release of NSS 3.44, destined for Firefox 68 ESR, specifically the ESR 68.9 release on 2 June 2020. When ready, the tag will be NSS_3_44_4_RTM.

This release will fix security bugs being disclosed on or after 2 June 2020, co-incident with ESR 68.9 and Firefox 77.

[Tracking Requested - why for this release]:
This will fix one or more serious vulnerabilities in Firefox cryptography code that affect ESR 68. See the bugs for their individual sec approvals.

Comment 1

[J.C. Jones [:jcj] (he/him)]

Tagged and released to the CDN. Uplift in progress.

Comment 2

[J.C. Jones [:jcj] (he/him)]

Attachment: Bug 1632908 - land NSS NSS_3_44_4_RTM UPGRADE_NSS_RELEASE, r=kjacobs

2020-05-19 J.C. Jones <[e-mail]>

* lib/nss/nss.h, lib/softoken/softkver.h, lib/util/nssutil.h:
Set version numbers to 3.44.4 final
[be8b38f87121] [NSS_3_44_4_RTM] <NSS_3_44_BRANCH>

2020-04-23 Robert Relyea <[e-mail]>

* lib/freebl/dsa.c:
Bug 1631576 - Force a fixed length for DSA exponentiation
r=pereida,bbrumley

[48612468b52f] <NSS_3_44_BRANCH>

2020-01-13 Kevin Jacobs <[e-mail]>

* automation/taskcluster/windows/build_gyp.sh:
Bug 1608895 - Install setuptools<45.0.0 until workers are upgraded
to python3 r=jcj

[[ https://setuptools.readthedocs.io/en/latest/history.html#v45-0-0
| Setuptools 45.0.0 ]] drops support for Python2, which our Windows
workers are running.

This patch installs the prior version during build, in order to
unblock CI until the workers can be upgraded.

[42186bde9062] <NSS_3_44_BRANCH>

2019-11-19 J.C. Jones <[e-mail]>

* .hgtags:
Added tag NSS_3_44_3_RTM for changeset d871fc63531d
[b6910cab5f1e] <NSS_3_44_BRANCH>

Comment 3

[J.C. Jones [:jcj] (he/him)]

Comment on attachment 9150315 [details]
Bug 1632908 - land NSS NSS_3_44_4_RTM UPGRADE_NSS_RELEASE, r=kjacobs

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: sec-high
• User impact if declined: Unpatched vuln
• Fix Landed on Version: 77
• Risk to taking this patch: Medium
• Why is the change risky/not risky? (and alternatives if risky): It's covered by automated tests for correctness. The actual fix has been analyzed, too.
• String or UUID changes made by this patch: n/a

Comment 4

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9150315 [details]
Bug 1632908 - land NSS NSS_3_44_4_RTM UPGRADE_NSS_RELEASE, r=kjacobs

Approved for 68.9esr.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr68/rev/555ae5322bbb