Skip to contentSkip to conversation

libnspr: bump version to 4.17

PATCH New Peter Korsgaard 2 participants 7 messages Oct 12, 2017 – Oct 17, 2017

lore
Share & tools
lore

Peter Korsgaard

author
#0 lore raw

PATCH 1/2 libnspr: bump version to 4.17

libnss 3.33 needs libnspr >= 4.17.

Also add a hash for the license file while we're at it.

Signed-off-by Peter Korsgaard <[email protected]>
---
 package/libnspr/libnspr.hash | 6 ++++--
 package/libnspr/libnspr.mk   | 2 +-
 2 files changed, 5 insertions(+), 3 deletions(-)
package/libnspr/libnspr.hash +4 -2
index 13cee6e7ef..46c091e0da 100644
@@ -1,2 +1,4 @@
-# From https://ftp.mozilla.org/pub/nspr/releases/v4.15/src/SHA256SUMS
-sha256	27dde06bc3d0c88903a20d6ad807361a912cfb624ca0ab4efb10fc50b19e2d80	nspr-4.15.tar.gz
+# From https://ftp.mozilla.org/pub/nspr/releases/v4.17/src/SHA256SUMS
+sha256	590a0aea29412ae22d7728038c21ef2ab42646e48172a47d2e4bb782846d1095  nspr-4.17.tar.gz
+# Locally calculated
+sha256	fab3dd6bdab226f1c08630b1dd917e11fcb4ec5e1e020e2c16f83a0a13863e85  nspr/LICENSE
package/libnspr/libnspr.mk +1 -1
index 7659baf6d3..0c782ae309 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBNSPR_VERSION = 4.15
+LIBNSPR_VERSION = 4.17
 LIBNSPR_SOURCE = nspr-$(LIBNSPR_VERSION).tar.gz
 LIBNSPR_SITE = https://ftp.mozilla.org/pub/mozilla.org/nspr/releases/v$(LIBNSPR_VERSION)/src
 LIBNSPR_SUBDIR = nspr
Signature · 1 line
2.11.0
author
#1 lore raw

PATCH 1/2 libnspr: bump version to 4.17

Quoted 6 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Korsgaard <[email protected]> writes:

libnss 3.33 needs libnspr >= 4.17.
Also add a hash for the license file while we're at it.

Signed-off-by Peter Korsgaard <[email protected]>

Committed to 2017.02.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard
#2 lore raw

PATCH 1/2 libnspr: bump version to 4.17

In reply to Peter Korsgaard

Hello,

Quoted 9 lines · Peter Korsgaard

libnss 3.33 needs libnspr >= 4.17.

Also add a hash for the license file while we're at it.

Signed-off-by Peter Korsgaard <[email protected]>
---
 package/libnspr/libnspr.hash | 6 ++++--
 package/libnspr/libnspr.mk   | 2 +-
 2 files changed, 5 insertions(+), 3 deletions(-)

Both applied. Thanks!

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com
author
#4 lore raw

PATCH 2/2 libnss: security bump to version 3.33

In reply to Peter Korsgaard

Fixes CVE-2017-7805 - Martin Thomson discovered that nss, the Mozilla Network Security Service library, is prone to a use-after-free vulnerability in the TLS 1.2 implementation when handshake hashes are generated. A remote attacker can take advantage of this flaw to cause an application using the nss library to crash, resulting in a denial of service, or potentially to execute arbitrary code.

Also add a hash for the license file while we're at it.

Signed-off-by Peter Korsgaard <[email protected]>
---
 package/libnss/libnss.hash | 6 ++++--
 package/libnss/libnss.mk   | 2 +-
 2 files changed, 5 insertions(+), 3 deletions(-)
package/libnss/libnss.hash +4 -2
index e4e24283cb..6c8ce83784 100644
@@ -1,2 +1,4 @@
-# From https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_31_RTM/src/SHA256SUMS
-sha256	e90561256a3271486162c1fbe8d614d118c333d36a4455be2af8688bd420a65d	nss-3.31.tar.gz
+# From https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_33_RTM/src/SHA256SUMS
+sha256	98f0dabd36408e83dd3a11727336cc3cdfee4cbdd9aede2b2831eb2389c284e4  nss-3.33.tar.gz
+# Locally calculated
+sha256	a20c1a32d1f8102432360b42e932869f7c11c7cdbacf9cac554c422132af47f4  nss/COPYING
package/libnss/libnss.mk +1 -1
index 51559295ef..27d305cc34 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBNSS_VERSION = 3.31
+LIBNSS_VERSION = 3.33
 LIBNSS_SOURCE = nss-$(LIBNSS_VERSION).tar.gz
 LIBNSS_SITE = https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_$(subst .,_,$(LIBNSS_VERSION))_RTM/src
 LIBNSS_DISTDIR = dist
Signature · 1 line
2.11.0
author
#5 lore raw

PATCH 2/2 libnss: security bump to version 3.33

Quoted 9 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Korsgaard <[email protected]> writes:

Fixes CVE-2017-7805 - Martin Thomson discovered that nss, the Mozilla Network Security Service library, is prone to a use-after-free vulnerability in the TLS 1.2 implementation when handshake hashes are generated. A remote attacker can take advantage of this flaw to cause an application using the nss library to crash, resulting in a denial of service, or potentially to execute arbitrary code.

Quoted 3 lines

Also add a hash for the license file while we're at it.

Signed-off-by Peter Korsgaard <[email protected]>

Committed to 2017.02.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard
author
#6 lore raw

PATCH 2/2 libnss: security bump to version 3.33

In reply to Peter Korsgaard
Quoted 9 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Korsgaard <[email protected]> writes:

Fixes CVE-2017-7805 - Martin Thomson discovered that nss, the Mozilla Network Security Service library, is prone to a use-after-free vulnerability in the TLS 1.2 implementation when handshake hashes are generated. A remote attacker can take advantage of this flaw to cause an application using the nss library to crash, resulting in a denial of service, or potentially to execute arbitrary code.

Quoted 3 lines

Also add a hash for the license file while we're at it.

Signed-off-by Peter Korsgaard <[email protected]>

Committed to 2017.08.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard