352754 - Upgrade NSS used by PSM to NSS release 3.11.3

Status: VERIFIED FIXED

(Core :: Security: PSM, defect)

Description

[Kai Engert [:KaiE:]]

We should upgrade NSS used by PSM to NSS release 3.11.3

Comment 1

[Kai Engert [:KaiE:]]

Attachment: Trunk patch v1

Comment 2

[Wan-Teh Chang]

Comment on attachment 238553 [details] [diff] [review]
Trunk patch v1

r=wtc.

Comment 3

[Kai Engert [:KaiE:]]

Attachment: 1.8 branch patch v1

Comment 4

[Wan-Teh Chang]

Comment on attachment 238557 [details] [diff] [review]
1.8 branch patch v1

r=wtc.

Comment 5

[Kai Engert [:KaiE:]]

fixed on trunk

Comment 6

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Is there something in here that's important for Firefox 2?  If so, it needs to get in by approximately yesterday at the latest...

Comment 7

[Wan-Teh Chang]

Sorry we missed the deadline.  I didn't know about
the deadline yesterday.  Most of the changes in this
patch are for FIPS validation.  One change is Solaris
only.  One change modifies conditionally compiled code.
We want Firefox 2.0 to use an official NSS release.

Comment 8

[Wan-Teh Chang]

Comment on attachment 238557 [details] [diff] [review]
1.8 branch patch v1

Requesting MOZILLA_1_8_BRANCH checkin approval.

The reason for the request is for Firefox 2 to use the
NSS 3.11.3 final release.  Right now Firefox 2 is using
NSS 3.11.2 Beta.  It doesn't look good to have a component
that is marked as Beta.

The changes in this patch are:

1. mozilla/security/nss/manifest.mn

Makefile change that doesn't affect Firefox.

2. mozilla/security/nss/lib/freebl/config.mk
   mozilla/security/nss/lib/freebl/unix_rand.c

A Solaris only change.  Doesn't affect any other platforms.

3. mozilla/security/nss/lib/nss/nss.h

Remove "Beta" from NSS version string.
Indicate the level of elliptic curve cryptography support
in the NSS version string.

4. mozilla/security/nss/lib/softoken/fipstest.c

Fixed a memory leak in the FIPS mode power-up self-test.

5. mozilla/security/nss/lib/softoken/fipstokn.c

Fixed a null pointer deference in the FIPS audit logging code.

6. mozilla/security/nss/lib/softoken/pkcs11c.c

A change required for the FIPS test program.  Does not
affect Firefox.

7. mozilla/security/nss/lib/ssl/ssl3con.c

Add more SSL tracing.  Most of the change is inside an #ifdef
that's not compiled by Firefox.

All changes have received at least two code reviews.

NSS 3.11.3 went through NSS's QA certification process.  We
tested NSS 3.11.3 with Firefox 2 and two server products, in
addition to running our own test suite.

The risk of this patch is low.

Comment 9

[Mike Schroepfer]

Comment on attachment 238557 [details] [diff] [review]
1.8 branch patch v1

Approved for RC2.

Comment 10

[Wan-Teh Chang]

Thanks. I checked in "1.8 branch patch v1" on the MOZILLA_1_8_BRANCH.

Comment 11

[Kevin Brosnan]

v. via lxr