NSS 3.108 Release

--000000000000811dde062de0be31
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Network Security Services (NSS) 3.108 was released on 4th February 2025.

The HG tag is NSS_3_108_RTM. This version of NSS requires NSPR
4.35 or newer. The latest version of NSPR is 4.36.

NSS 3.108 source distributions are available on ftp.mozilla.org
for secure HTTPS download:
<https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_108_RTM/src/>

Changes:

   - Bug 1923285 - libclang-16 -> libclang-19
   - Bug 1939086 - Turn off Secure Email Trust Bit for Security
Communication ECC RootCA1.
   - Bug 1937332 - Turn off Secure Email Trust Bit for BJCA Global Root CA1
and BJCA Global Root CA2.
   - Bug 1915902 - Remove SwissSign Silver CA =E2=80=93 G2.
   - Bug 1938245 - Add D-Trust 2023 TLS Roots to NSS
   - Bug 1942301 - fix fips test failure on windows.
   - Bug 1935925 - change default sensitivity of KEM keys.
   - Bug 1936001 - Part 1: Introduce frida hooks and script,
   - Bug 1942350 - add missing arm_neon.h include to gcm.c.
   - Bug 1831552 - ci: update windows workers to win2022
r=3Dnss-reviewers,nkulatova NSS_3_108_BETA2
   - Bug 1831552 - strip trailing carriage returns in tools tests
r=3Dnss-reviewers,nkulatova
   - Bug 1880256 - work around unix/windows path translation issues in cert
test script r=3Dnss-reviewers,nkulatova
   - Bug 1831552 - ci: let the windows setup script work without $m
r=3Dnss-reviewers,nkulatova
   - Bug 1880255 - detect msys r=3Dnss-reviewers,nkulatova
   - Bug 1936680 - add a specialized CTR_Update variant for AES-GCM.
r=3Dnss-reviewers,keeler
   - Bug 1930807 NSS policy updates - cavs NSS_3_108_BETA1
   - Bug 1930806 FIPS changes need to be upstreamed: FIPS 140-3 RNG
   - Bug 1930806 FIPS changes need to be upstreamed: Add SafeZero
   - Bug 1930806 FIPS changes need to be upstreamed - updated POST
   - Bug 1933031 Segmentation fault in SECITEM_Hash during pkcs12 processin=
g
   - Bug 1929922 - Extending NSS with LoadModuleFromFunction functionality
r=3Dkeeler,nss-reviewers
   - Bug 1935984 - Ensure zero-initialization of collectArgs.cert,
r=3Ddjackson,nss-reviewers
   - Bug 1934526 - pkcs7 fuzz target use CERT_DestroyCertificate,
r=3Ddjackson,nss-reviewers
   - Bug 1915898 - Fix actual underlying ODR violations issue,
r=3Ddjackson,nss-reviewers
   - Bug 1184059 - mozilla::pkix: allow reference ID labels to begin and/or
end with hyphens r=3Djschanck
   - Bug 1927953 - don't look for secmod.db in nssutil_ReadSecmodDB if
NSS_DISABLE_DBM is set r=3Djschanck
   - Bug 1934526 - Fix memory leak in pkcs7 fuzz target,
r=3Ddjackson,nss-reviewers
   - Bug 1934529 - Set -O2 for ASan builds in CI, r=3Ddjackson,nss-reviewer=
s
   - Bug 1934543 - Change branch of tlsfuzzer dependency,
r=3Ddjackson,nss-reviewers
   - Bug 1915898 - Run tests in CI for ASan builds with
detect_odr_violation=3D1, r=3Ddjackson,nss-reviewers
   - Bug 1934241 - Fix coverage failure in CI, r=3Ddjackson,nss-reviewers
   - Bug 1934213 - Add fuzzing for delegated credentials, DTLS short header
and Tls13BackendEch, r=3Ddjackson,nss-reviewers
   - Bug 1927142 - Add fuzzing for SSL_EnableTls13GreaseEch and
SSL_SetDtls13VersionWorkaround, r=3Ddjackson,nss-reviewers
   - Bug 1913677 - Part 3: Restructure fuzz/, r=3Ddjackson,nss-reviewers
   - Bug 1931925 - Extract testcases from ssl gtests for fuzzing,
r=3Ddjackson,nss-reviewers
   - Bug 1923037 - Force Cryptofuzz to use NSS in CI,
r=3Dnss-reviewers,nkulatova
   - Bug 1923037 - Fix Cryptofuzz on 32 bit in CI, r=3Dnss-reviewers,nkulat=
ova
   - Bug 1933154 - Update Cryptofuzz repository link,
r=3Dnss-reviewers,nkulatova
   - Bug 1926256 - fix build error from 9505f79d r=3Djschanck
   - Bug 1926256 - simplify error handling in get_token_objects_for_cache.
r=3Drrelyea
   - Bug 1931973 - nss doc: fix a warning r=3Dbbeurdouche
   - Bug 1930797 pkcs12 fixes from RHEL need to be picked up.

NSS 3.108 shared libraries are backwards-compatible with all
older NSS 3.x shared libraries. A program linked with older NSS
3.x shared libraries will work with this new version of the
shared libraries without recompiling or relinking. Furthermore,
applications that restrict their use of NSS APIs to the
functions listed in NSS Public Functions will remain compatible
with future versions of the NSS shared libraries.

Bugs discovered should be reported by filing a bug report at
<https://bugzilla.mozilla.org/enter_bug.cgi?product=3DNSS>

Release notes are available, after a short delay, at
<https://firefox-source-docs.mozilla.org/security/nss/releases/index.html>.

--=20
You received this message because you are subscribed to the Google Groups "=
[email protected]" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to [email protected].
To view this discussion visit https://groups.google.com/a/mozilla.org/d/msg=
id/dev-tech-crypto/CAON8YFMAfBWTUfpXs6NPOR6vtLOD4SrFeT2YBXSfewNGRQ1m-g%40ma=
il.gmail.com.

--000000000000811dde062de0be31
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Network Security Services (NSS) 3.108 was released on 4th =
February 2025.<br>
<br>
The HG tag is NSS_3_108_RTM. This version of NSS requires NSPR<br>
4.35 or newer. The latest version of NSPR is 4.36.<br>
<br>
NSS 3.108 source distributions are available on <a href=3D"http://ftp.mozil=
la.org" rel=3D"noreferrer" target=3D"_blank">ftp.mozilla.org</a><br>
for secure HTTPS download:<br>
&lt;<a href=3D"https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_108_=
RTM/src/" rel=3D"noreferrer" target=3D"_blank">https://ftp.mozilla.org/pub/=
security/nss/releases/NSS_3_108_RTM/src/</a>&gt;<br>
<br>
Changes:<br>
<br>
=C2=A0=C2=A0 - Bug 1923285 - libclang-16 -&gt; libclang-19<br>=C2=A0 =C2=A0=
- Bug 1939086 - Turn off Secure Email Trust Bit for Security Communication =
ECC RootCA1.<br>=C2=A0 =C2=A0- Bug 1937332 - Turn off Secure Email Trust Bi=
t for BJCA Global Root CA1 and BJCA Global Root CA2.<br>=C2=A0 =C2=A0- Bug =
1915902 - Remove SwissSign Silver CA =E2=80=93 G2.<br>=C2=A0 =C2=A0- Bug 19=
38245 - Add D-Trust 2023 TLS Roots to NSS<br>=C2=A0 =C2=A0- Bug 1942301 - f=
ix fips test failure on windows.<br>=C2=A0 =C2=A0- Bug 1935925 - change def=
ault sensitivity of KEM keys.<br>=C2=A0 =C2=A0- Bug 1936001 - Part 1: Intro=
duce frida hooks and script,<br>=C2=A0 =C2=A0- Bug 1942350 - add missing ar=
m_neon.h include to gcm.c.<br>=C2=A0 =C2=A0- Bug 1831552 - ci: update windo=
ws workers to win2022 r=3Dnss-reviewers,nkulatova NSS_3_108_BETA2<br>=C2=A0=
 =C2=A0- Bug 1831552 - strip trailing carriage returns in tools tests r=3Dn=
ss-reviewers,nkulatova<br>=C2=A0 =C2=A0- Bug 1880256 - work around unix/win=
dows path translation issues in cert test script r=3Dnss-reviewers,nkulatov=
a<br>=C2=A0 =C2=A0- Bug 1831552 - ci: let the windows setup script work wit=
hout $m r=3Dnss-reviewers,nkulatova<br>=C2=A0 =C2=A0- Bug 1880255 - detect =
msys r=3Dnss-reviewers,nkulatova<br>=C2=A0 =C2=A0- Bug 1936680 - add a spec=
ialized CTR_Update variant for AES-GCM. r=3Dnss-reviewers,keeler<br>=C2=A0 =
=C2=A0- Bug 1930807 NSS policy updates - cavs NSS_3_108_BETA1<br>=C2=A0 =C2=
=A0- Bug 1930806 FIPS changes need to be upstreamed: FIPS 140-3 RNG<br>=C2=
=A0 =C2=A0- Bug 1930806 FIPS changes need to be upstreamed: Add SafeZero<br=
>=C2=A0 =C2=A0- Bug 1930806 FIPS changes need to be upstreamed - updated PO=
ST<br>=C2=A0 =C2=A0- Bug 1933031 Segmentation fault in SECITEM_Hash during =
pkcs12 processing<br>=C2=A0 =C2=A0- Bug 1929922 - Extending NSS with LoadMo=
duleFromFunction functionality r=3Dkeeler,nss-reviewers<br>=C2=A0 =C2=A0- B=
ug 1935984 - Ensure zero-initialization of collectArgs.cert, r=3Ddjackson,n=
ss-reviewers<br>=C2=A0 =C2=A0- Bug 1934526 - pkcs7 fuzz target use CERT_Des=
troyCertificate, r=3Ddjackson,nss-reviewers<br>=C2=A0 =C2=A0- Bug 1915898 -=
 Fix actual underlying ODR violations issue, r=3Ddjackson,nss-reviewers<br>=
=C2=A0 =C2=A0- Bug 1184059 - mozilla::pkix: allow reference ID labels to be=
gin and/or end with hyphens r=3Djschanck<br>=C2=A0 =C2=A0- Bug 1927953 - do=
n&#39;t look for secmod.db in nssutil_ReadSecmodDB if NSS_DISABLE_DBM is se=
t r=3Djschanck<br>=C2=A0 =C2=A0- Bug 1934526 - Fix memory leak in pkcs7 fuz=
z target, r=3Ddjackson,nss-reviewers<br>=C2=A0 =C2=A0- Bug 1934529 - Set -O=
2 for ASan builds in CI, r=3Ddjackson,nss-reviewers<br>=C2=A0 =C2=A0- Bug 1=
934543 - Change branch of tlsfuzzer dependency, r=3Ddjackson,nss-reviewers<=
br>=C2=A0 =C2=A0- Bug 1915898 - Run tests in CI for ASan builds with detect=
_odr_violation=3D1, r=3Ddjackson,nss-reviewers<br>=C2=A0 =C2=A0- Bug 193424=
1 - Fix coverage failure in CI, r=3Ddjackson,nss-reviewers<br>=C2=A0 =C2=A0=
- Bug 1934213 - Add fuzzing for delegated credentials, DTLS short header an=
d Tls13BackendEch, r=3Ddjackson,nss-reviewers<br>=C2=A0 =C2=A0- Bug 1927142=
 - Add fuzzing for SSL_EnableTls13GreaseEch and SSL_SetDtls13VersionWorkaro=
und, r=3Ddjackson,nss-reviewers<br>=C2=A0 =C2=A0- Bug 1913677 - Part 3: Res=
tructure fuzz/, r=3Ddjackson,nss-reviewers<br>=C2=A0 =C2=A0- Bug 1931925 - =
Extract testcases from ssl gtests for fuzzing, r=3Ddjackson,nss-reviewers<b=
r>=C2=A0 =C2=A0- Bug 1923037 - Force Cryptofuzz to use NSS in CI, r=3Dnss-r=
eviewers,nkulatova<br>=C2=A0 =C2=A0- Bug 1923037 - Fix Cryptofuzz on 32 bit=
 in CI, r=3Dnss-reviewers,nkulatova<br>=C2=A0 =C2=A0- Bug 1933154 - Update =
Cryptofuzz repository link, r=3Dnss-reviewers,nkulatova<br>=C2=A0 =C2=A0- B=
ug 1926256 - fix build error from 9505f79d r=3Djschanck<br>=C2=A0 =C2=A0- B=
ug 1926256 - simplify error handling in get_token_objects_for_cache. r=3Drr=
elyea<br>=C2=A0 =C2=A0- Bug 1931973 - nss doc: fix a warning r=3Dbbeurdouch=
e<br>=C2=A0 =C2=A0- Bug 1930797 pkcs12 fixes from RHEL need to be picked up=
.<br><br>
NSS 3.108 shared libraries are backwards-compatible with all<br>
older NSS 3.x shared libraries. A program linked with older NSS<br>
3.x shared libraries will work with this new version of the<br>
shared libraries without recompiling or relinking. Furthermore,<br>
applications that restrict their use of NSS APIs to the<br>
functions listed in NSS Public Functions will remain compatible<br>
with future versions of the NSS shared libraries.<br>
<br>
Bugs discovered should be reported by filing a bug report at<br>
&lt;<a href=3D"https://bugzilla.mozilla.org/enter_bug.cgi?product=3DNSS" re=
l=3D"noreferrer" target=3D"_blank">https://bugzilla.mozilla.org/enter_bug.c=
gi?product=3DNSS</a>&gt;<br>
<br>
Release notes are available, after a short delay, at<br>
&lt;<a href=3D"https://firefox-source-docs.mozilla.org/security/nss/release=
s/index.html" rel=3D"noreferrer" target=3D"_blank">https://firefox-source-d=
ocs.mozilla.org/security/nss/releases/index.html</a>&gt;.<font color=3D"#88=
8888"><br>
</font><br></div>

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;[email protected]&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]">dev-tech=
[email protected]</a>.<br />
To view this discussion visit <a href=3D"https://groups.google.com/a/mozill=
a.org/d/msgid/dev-tech-crypto/CAON8YFMAfBWTUfpXs6NPOR6vtLOD4SrFeT2YBXSfewNG=
RQ1m-g%40mail.gmail.com?utm_medium=3Demail&utm_source=3Dfooter">https://gro=
ups.google.com/a/mozilla.org/d/msgid/dev-tech-crypto/CAON8YFMAfBWTUfpXs6NPO=
R6vtLOD4SrFeT2YBXSfewNGRQ1m-g%40mail.gmail.com</a>.<br />

--000000000000811dde062de0be31--