blob: 6bcaf940436528223b8c8913180637541d004cd0 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
|
---
title: NSS 3.33 release notes
slug: Mozilla/Projects/NSS/NSS_3.33_release_notes
translation_of: Mozilla/Projects/NSS/NSS_3.33_release_notes
---
<h2 id="Einführung">Einführung</h2>
<p>Das Network Security Services (NSS) Team hat NSS 3.33 veröffentlicht, was eine Nebenversion darstellt.</p>
<h2 id="Distribution_information">Distribution information</h2>
<p>The hg tag is NSS_3_33_RTM. NSS 3.33 requires Netscape Portable Runtime (NSPR) 4.17 or newer.</p>
<p>NSS 3.33 source distributions are available on ftp.mozilla.org for secure HTTPS download:</p>
<ul>
<li>Source tarballs:<br>
<a href="https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_33_RTM/src/">https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_33_RTM/src/</a></li>
</ul>
<h2 id="Bedeutende_Änderungen_in_NSS_3.33">Bedeutende Änderungen in NSS 3.33</h2>
<ul>
<li>TLS-Kompression wird nicht mehr unterstützt. API calls that attempt to enable compression are accepted without failure. However, TLS compression will remain disabled.</li>
<li>Diese Version von NSS verwendet eine <a href="https://blog.mozilla.org/security/2017/09/13/verified-cryptography-firefox-57/">formal bestätigte Implementierung</a> von Curve25519 auf 64-Bit-Systemen.</li>
<li>The compile time flag DISABLE_ECC has been removed.</li>
<li>When NSS is compiled without NSS_FORCE_FIPS=1 startup checks are not performed anymore.</li>
<li>Fixes CVE-2017-7805, a potential use-after-free in TLS 1.2 server when verifying client authentication</li>
<li>Various minor improvements and correctness fixes.</li>
</ul>
<h2 id="Neu_in_NSS_3.33">Neu in NSS 3.33</h2>
<h3 id="Neue_Funktionalität">Neue Funktionalität</h3>
<ul>
<li>When listing an NSS database using certutil -L, but the database hasn't yet been initialized with any non-empty or empty password, the text "Database needs user init" will be included in the listing.</li>
<li>When using certutil to set an inacceptable password in FIPS mode, a correct explanation of acceptable passwords will be printed.</li>
</ul>
<h4 id="Neue_Funktionen">Neue Funktionen</h4>
<ul>
<li><em>in cert.h</em>
<ul>
<li><strong>CERT_FindCertByIssuerAndSNCX</strong> - a variation of existing function CERT_FindCertByIssuerAndSN that accepts an additional password context parameter.</li>
<li><strong>CERT_FindCertByNicknameOrEmailAddrCX</strong> - a variation of existing function CERT_FindCertByNicknameOrEmailAddr that accepts an additional password context parameter.</li>
<li><strong>CERT_FindCertByNicknameOrEmailAddrForUsageCX</strong> - a variation of existing function CERT_FindCertByNicknameOrEmailAddrForUsage that accepts an additional password context parameter.</li>
</ul>
</li>
<li><em>in secport.h</em>
<ul>
<li><strong>NSS_SecureMemcmpZero</strong> - check if a memory region is all zero in constant time.</li>
<li><strong>PORT_ZAllocAligned</strong> - allocate aligned memory.</li>
<li><strong>PORT_ZAllocAlignedOffset</strong> - allocate aligned memory for structs.</li>
</ul>
</li>
<li><em>in ssl.h</em>
<ul>
<li><strong>SSL_GetExperimentalAPI</strong> - access experimental APIs in libssl.</li>
</ul>
</li>
</ul>
<h2 id="Fehler_behoben_in_NSS_3.33">Fehler behoben in NSS 3.33</h2>
<p>This Bugzilla query returns all the bugs fixed in NSS 3.33:</p>
<p><a href="https://bugzilla.mozilla.org/buglist.cgi?resolution=FIXED&classification=Components&query_format=advanced&product=NSS&target_milestone=3.33">https://bugzilla.mozilla.org/buglist.cgi?resolution=FIXED&classification=Components&query_format=advanced&product=NSS&target_milestone=3.33</a></p>
<h2 id="Kompatibilität">Kompatibilität</h2>
<p>NSS 3.33 shared libraries are backward compatible with all older NSS 3.x shared libraries. A program linked with older NSS 3.x shared libraries will work with NSS 3.33 shared libraries without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs to the functions listed in NSS Public Functions will remain compatible with future versions of the NSS shared libraries.</p>
<h2 id="Rückmeldung">Rückmeldung</h2>
<p>Entdeckte Fehler sollten durch das Ausfüllen eines Fehlerberichts mithilfe von<a href="https://bugzilla.mozilla.org/enter_bug.cgi?product=NSS"> bugzilla.mozilla.org</a> gemeldet werden (Produkt NSS).</p>
|
