1643859 - Upgrade Firefox 78 to use NSS 3.53.1

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P1)

Description

[J.C. Jones [:jcj] (he/they)]

[Tracking Requested - why for this release]:

This security bug tracks the release of NSS 3.53.1, a security release of NSS 3.53, destined for Firefox 78. When ready, the tag will be NSS_3_53_1_RTM.

This release will fix security bugs being disclosed on or after 30 June 2020, co-incident with Firefox 78.

Comment 1

[J.C. Jones [:jcj] (he/they)]

Attachment: Bug 1643859 - land NSS NSS_3_53_1_RTM UPGRADE_NSS_RELEASE, r=kjacobs

2020-06-16 J.C. Jones <[e-mail]>

* lib/nss/nss.h, lib/softoken/softkver.h, lib/util/nssutil.h:
Set version numbers to 3.53.1 final
[610d224a39fa] [NSS_3_53_1_RTM] <NSS_3_53_BRANCH>

2020-06-08 Sohaib ul Hassan <[e-mail]>

* lib/freebl/mpi/mpi.c, lib/freebl/mpi/mpi.h,
lib/freebl/mpi/mplogic.c:
Bug 1631597 - Constant-time GCD and modular inversion
r=rrelya,kjacobs

The implementation is based on the work by Bernstein and Yang
(https://eprint.iacr.org/2019/266) "Fast constant-time gcd
computation and modular inversion". It fixes the old mp_gcd and
s_mp_invmod_odd_m functions.

The patch also fix mpl_significant_bits s_mp_div_2d and s_mp_mul_2d
by having less control flow to reduce side-channel leaks.

Co Author : Billy Bob Brumley

[04ea6dc51e74] <NSS_3_53_BRANCH>

2020-05-29 J.C. Jones <[e-mail]>

* .hgtags:
Added tag NSS_3_53_RTM for changeset 7e453a5afcb4
[5c1dff547a19] <NSS_3_53_BRANCH>

Comment 2

[J.C. Jones [:jcj] (he/they)]

Comment on attachment 9157131 [details]
Bug 1643859 - land NSS NSS_3_53_1_RTM UPGRADE_NSS_RELEASE, r=kjacobs

Beta/Release Uplift Approval Request

• User impact if declined: security bugfix
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Medium
• Why is the change risky/not risky? (and alternatives if risky): It's a revision to how the RSA cipher is implemented, but it is covered by many tests in both Firefox and in NSS.
• String changes made/needed: None

Comment 3

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9157131 [details]
Bug 1643859 - land NSS NSS_3_53_1_RTM UPGRADE_NSS_RELEASE, r=kjacobs

Approved for 78.0b8.

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/7e670bc63fef