package/libnss: security bump to version 3.73
PATCH 1/1 package/libnss: security bump to version 3.73
Fixes the following security issue:
- CVE-2021-43527: Heap overflow in NSS when verifying DSA/RSA-PSS DER-encoded signatures
For more details, see the advisory:
https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/
--- package/libnss/libnss.hash | 4 ++-- package/libnss/libnss.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
package/libnss/libnss.hash +2 -2
@@ -1,4 +1,4 @@ -# From https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_72_RTM/src/SHA256SUMS -sha256 6ea60a9ff113e493ea2ab25f41ea75a9fbd10af7903f26f703dac8680732d02e nss-3.72.tar.gz +# From https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_73_RTM/src/SHA256SUMS +sha256 566d3a68da9b10d7da9ef84eb4fe182f8f04e20d85c55d1bf360bb2c0096d8e5 nss-3.73.tar.gz # Locally calculated sha256 a20c1a32d1f8102432360b42e932869f7c11c7cdbacf9cac554c422132af47f4 nss/COPYING
package/libnss/libnss.mk +1 -1
@@ -4,7 +4,7 @@ # ################################################################################ -LIBNSS_VERSION = 3.72 +LIBNSS_VERSION = 3.73 LIBNSS_SOURCE = nss-$(LIBNSS_VERSION).tar.gz LIBNSS_SITE = https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_$(subst .,_,$(LIBNSS_VERSION))_RTM/src LIBNSS_DISTDIR = dist
Signature · 6 lines
2.20.1 _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Hi Peter,
Quoted 11 lines
Il giorno 2 dic 2021, alle ore 22:34, Peter Korsgaard <[email protected]> ha scritto:
Fixes the following security issue:
- CVE-2021-43527: Heap overflow in NSS when verifying DSA/RSA-PSS DER-encoded signatures
For more details, see the advisory:
https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/Signed-off-by Peter Korsgaard <[email protected]>
You’ve beaten me on time :-)
Best regards
Giulio Benetti
Quoted 26 lines
---
package/libnss/libnss.hash | 4 ++--package/libnss/libnss.mk| 2 +-2 files changed, 3 insertions(+), 3 deletions(-)package/libnss/libnss.hash +2
-2@@ -1,4 +1,4 @@ -# From https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_72_RTM/src/SHA256SUMS -sha256 6ea60a9ff113e493ea2ab25f41ea75a9fbd10af7903f26f703dac8680732d02e nss-3.72.tar.gz +# From https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_73_RTM/src/SHA256SUMS +sha256 566d3a68da9b10d7da9ef84eb4fe182f8f04e20d85c55d1bf360bb2c0096d8e5 nss-3.73.tar.gz # Locally calculatedsha256
a20c1a32d1f8102432360b42e932869f7c11c7cdbacf9cac554c422132af47f4nss/COPYINGpackage/libnss/libnss.mk +1
-1@@ -4,7 +4,7 @@ # ################################################################################ -LIBNSS_VERSION = 3.72 +LIBNSS_VERSION = 3.73
Quoted 6 lines
LIBNSS_SOURCE= nss-$(LIBNSS_VERSION).tar.gzLIBNSS_SITE= https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_$(subst .,_,$(LIBNSS_VERSION))_RTM/srcLIBNSS_DISTDIR= distSignature · 1 line
2.20.1
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
Quoted 10 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Peter" == Peter Korsgaard <[email protected]> writes:
Fixes the following security issue:
- CVE-2021-43527: Heap overflow in NSS when verifying DSA/RSA-PSS DER-encoded signaturesFor more details, see the advisory:
https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/Signed-off-by Peter Korsgaard <[email protected]>
Committed, thanks.
Signature · 5 lines
Bye, Peter Korsgaard _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Quoted 10 lines
Quoted 10 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Peter" == Peter Korsgaard <[email protected]> writes:
Fixes the following security issue:
- CVE-2021-43527: Heap overflow in NSS when verifying DSA/RSA-PSS DER-encoded signaturesFor more details, see the advisory:
https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/Signed-off-by Peter Korsgaard <[email protected]>
For 2021.02.x / 2021.08.x I have instead bumped to 3.68.1, which fixes the same vulnerability.
Signature · 5 lines
Bye, Peter Korsgaard _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot