Freeze break request for NSS

Good afternoon,

While I was poking around at Arch to figure something else out with 
valgrind, I noticed that they had a new version of NSS.

It looks like NSS-3.120.1 was released on February 11th, but the 
currency scripts haven't picked up on it. It's available at it's normal 
location, and I'd like to request that it gets updated for BLFS 13.0 
because of the following items in the release notes:

"Bug 2009552 - avoid integer overflow in platform-independent ghash"

Integer overflows can be exploited as a security vulnerability, and I'd 
thus like to request that it gets updated.

Looking into the branch further, I noticed some additional commits that 
made it into this release but weren't listed in the release notes:

"Bug 2008112 - Out-of-Bounds Read in ML-DSA Private Key Parsing 
(zero-length privateKey"

"Bug 2007911 - FORWARD_NULL null deref of worker in p7decode.c 
(sec_pkcs7_decoder_abort_digests)"

"Bug 2000737 - simplify compilation of platform-specific GCM and GHASH."

"Bug 2000737 - rename C files for platform-specific ghash implementations."

"Bug 2000737 - rename intel-{aes,gcm}.s to .S."

"Bug 2000737 - Darwin compatibility for intel-aes.S and intel-gcm.S."

"Bug 2001167: Paranoia assert."

"Bug 2009998 - Update cryptofuzz version"

"Bug 2005516 - allow manual selection of CPU_ARCH=x86_64 and ppc64 in 
coreconf/Darwin.mk."

"Bug 2010389 - Add e-Szigno TLS Root CA 2023 to NSS."

"Bug 2010389 - Set nssckbi version to 2.84."

"Bug 2013188 - add gcm.gyp dependency for Solaris SPARC builds."

"Bug 2012313 - fix build with glibc-2.43 assignment discards 'const' 
qualifier from pointer."

"Bug 2003189 - Fix errant whitespace in OISTE Server Root RSA G1 nickname."


The log for this version can be found at 
https://hg-edge.mozilla.org/projects/nss/log/80e5c1939f9babba274362f9efbf3db87391ce64 
- you'll need to click on -20 is required if you want to see when 
3.120.0 was tagged.

Note that this includes a root certificate update as well based on the 
above information. I did look and there doesn't seem to be any API 
changes that would be problematic for us here, they are mostly bugfixes 
(and the C files for platform specific ghash implementations are 
internal). There's also a glibc build fix here but I don't think we were 
ever affected by it since the package is currently tagged.

- Doug

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-dev
Unsubscribe: See the above information page