Merge ~athos-ribeiro/ubuntu/+source/nss:lp1959126-upstream-3.68.2 into ubuntu/+source/nss:ubuntu/devel

[Athos Ribeiro]

This MP updates nss from 3.68 to 3.68.2. Note that this new version is not available in Debian, which is already in 3.7x. We decided to remain in 3.68.2 due to the fact that it is an LTS release and is more suitable for jammy.

This new version includes two bug fixes. One of them was already applied in our delta (hence the dropped patch). It also adds support to SHA-2 hashes in CertIDs in OCSP responses.

There are no symbol changes for this new version and no transition should be required.

a PPA with the proposed changes is available at:
https://launchpad.net/~athos-ribeiro/+archive/ubuntu/lp1959126-nss-jammy/+packages

This package has no dep8 tests.

[Lucas Kanashiro (lucaskanashiro)]

Thanks Athos. The update looks good, the package in the PPA installs/upgrades fine, nothing suspicious showed up in the build logs, and according to upstream no rebuild of reverse dependencies is needed indeed.

The only thing that we could do to improve the changelog entry, in my opinion, is mentioning the fix of the CVE-2021-43527 which according to the upstream is a critical issue:

https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/

This is not a blocker, it is just a plus. Feel free to ignore this if you believe it is not needed. Also let me know if you need a sponsor for this upload.

review: Approve

[Lucas Kanashiro (lucaskanashiro)]

I overlooked the CVE number, it was already fixed in the previous release :) no need to mention it again, sorry for the noise.

[Lucas Kanashiro (lucaskanashiro)]

Package uploaded as requested by Athos:

$ dput ubuntu ../nss_3.68.2-0ubuntu1_source.changes
Checking signature on .changes
gpg: ../nss_3.68.2-0ubuntu1_source.changes: Valid signature from F823A2729883C97C
Checking signature on .dsc
gpg: ../nss_3.68.2-0ubuntu1.dsc: Valid signature from F823A2729883C97C
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading nss_3.68.2-0ubuntu1.dsc: done.
  Uploading nss_3.68.2.orig.tar.gz: done.
  Uploading nss_3.68.2-0ubuntu1.debian.tar.xz: done.
  Uploading nss_3.68.2-0ubuntu1_source.buildinfo: done.
  Uploading nss_3.68.2-0ubuntu1_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index dcda4b0..2bfdd70 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+nss (2:3.68.2-0ubuntu1) jammy; urgency=medium
+
+  * New upstream release. (LP: #1959126)
+  * d/p/CVE-2021-43527.patch: drop patch applied upstream.
+    [ Fixed in 3.68.1 ]
+
+ -- Athos Ribeiro <[e-mail]>  Mon, 21 Feb 2022 14:55:42 -0300
+
 nss (2:3.68-1ubuntu2) jammy; urgency=medium
 
   * SECURITY UPDATE: heap overflow when verifying DSA/RSA-PSS DER-encoded
diff --git a/debian/patches/CVE-2021-43527.patch b/debian/patches/CVE-2021-43527.patch
deleted file mode 100644
index a663236..0000000
--- a/debian/patches/CVE-2021-43527.patch
+++ /dev/null
@@ -1,282 +0,0 @@
-Description: fix heap overflow when verifying DSA/RSA-PSS DER-encoded signatures
-Origin: Provided by Mozilla
-
-diff --git a/nss/lib/cryptohi/secvfy.c b/nss/lib/cryptohi/secvfy.c
---- a/nss/lib/cryptohi/secvfy.c
-+++ b/nss/lib/cryptohi/secvfy.c
-@@ -164,6 +164,37 @@
-         PR_FALSE /*XXX: unsafeAllowMissingParameters*/);
- }
- 
-+static unsigned int
-+checkedSignatureLen(const SECKEYPublicKey *pubk)
-+{
-+    unsigned int sigLen = SECKEY_SignatureLen(pubk);
-+    if (sigLen == 0) {
-+        /* Error set by SECKEY_SignatureLen */
-+        return sigLen;
-+    }
-+    unsigned int maxSigLen;
-+    switch (pubk->keyType) {
-+        case rsaKey:
-+        case rsaPssKey:
-+            maxSigLen = (RSA_MAX_MODULUS_BITS + 7) / 8;
-+            break;
-+        case dsaKey:
-+            maxSigLen = DSA_MAX_SIGNATURE_LEN;
-+            break;
-+        case ecKey:
-+            maxSigLen = 2 * MAX_ECKEY_LEN;
-+            break;
-+        default:
-+            PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG);
-+            return 0;
-+    }
-+    if (sigLen > maxSigLen) {
-+        PORT_SetError(SEC_ERROR_INVALID_KEY);
-+        return 0;
-+    }
-+    return sigLen;
-+}
-+
- /*
-  * decode the ECDSA or DSA signature from it's DER wrapping.
-  * The unwrapped/raw signature is placed in the buffer pointed
-@@ -174,38 +205,38 @@
-                        unsigned int len)
- {
-     SECItem *dsasig = NULL; /* also used for ECDSA */
--    SECStatus rv = SECSuccess;
- 
--    if ((algid != SEC_OID_ANSIX9_DSA_SIGNATURE) &&
--        (algid != SEC_OID_ANSIX962_EC_PUBLIC_KEY)) {
--        if (sig->len != len) {
--            PORT_SetError(SEC_ERROR_BAD_DER);
--            return SECFailure;
-+    /* Safety: Ensure algId is as expected and that signature size is within maxmimums */
-+    if (algid == SEC_OID_ANSIX9_DSA_SIGNATURE) {
-+        if (len > DSA_MAX_SIGNATURE_LEN) {
-+            goto loser;
-         }
--
--        PORT_Memcpy(dsig, sig->data, sig->len);
--        return SECSuccess;
-+    } else if (algid == SEC_OID_ANSIX962_EC_PUBLIC_KEY) {
-+        if (len > MAX_ECKEY_LEN * 2) {
-+            goto loser;
-+        }
-+    } else {
-+        goto loser;
-     }
- 
--    if (algid == SEC_OID_ANSIX962_EC_PUBLIC_KEY) {
--        if (len > MAX_ECKEY_LEN * 2) {
--            PORT_SetError(SEC_ERROR_BAD_DER);
--            return SECFailure;
--        }
-+    /* Decode and pad to length */
-+    dsasig = DSAU_DecodeDerSigToLen((SECItem *)sig, len);
-+    if (dsasig == NULL) {
-+        goto loser;
-     }
--    dsasig = DSAU_DecodeDerSigToLen((SECItem *)sig, len);
--
--    if ((dsasig == NULL) || (dsasig->len != len)) {
--        rv = SECFailure;
--    } else {
--        PORT_Memcpy(dsig, dsasig->data, dsasig->len);
-+    if (dsasig->len != len) {
-+        SECITEM_FreeItem(dsasig, PR_TRUE);
-+        goto loser;
-     }
- 
--    if (dsasig != NULL)
--        SECITEM_FreeItem(dsasig, PR_TRUE);
--    if (rv == SECFailure)
--        PORT_SetError(SEC_ERROR_BAD_DER);
--    return rv;
-+    PORT_Memcpy(dsig, dsasig->data, len);
-+    SECITEM_FreeItem(dsasig, PR_TRUE);
-+
-+    return SECSuccess;
-+
-+loser:
-+    PORT_SetError(SEC_ERROR_BAD_DER);
-+    return SECFailure;
- }
- 
- const SEC_ASN1Template hashParameterTemplate[] =
-@@ -281,7 +312,7 @@
- sec_DecodeSigAlg(const SECKEYPublicKey *key, SECOidTag sigAlg,
-                  const SECItem *param, SECOidTag *encalgp, SECOidTag *hashalg)
- {
--    int len;
-+    unsigned int len;
-     PLArenaPool *arena;
-     SECStatus rv;
-     SECItem oid;
-@@ -466,48 +497,52 @@
-     cx->pkcs1RSADigestInfo = NULL;
-     rv = SECSuccess;
-     if (sig) {
--        switch (type) {
--            case rsaKey:
--                rv = recoverPKCS1DigestInfo(hashAlg, &cx->hashAlg,
--                                            &cx->pkcs1RSADigestInfo,
--                                            &cx->pkcs1RSADigestInfoLen,
--                                            cx->key,
--                                            sig, wincx);
--                break;
--            case rsaPssKey:
--                sigLen = SECKEY_SignatureLen(key);
--                if (sigLen == 0) {
--                    /* error set by SECKEY_SignatureLen */
--                    rv = SECFailure;
-+        rv = SECFailure;
-+        if (type == rsaKey) {
-+            rv = recoverPKCS1DigestInfo(hashAlg, &cx->hashAlg,
-+                                        &cx->pkcs1RSADigestInfo,
-+                                        &cx->pkcs1RSADigestInfoLen,
-+                                        cx->key,
-+                                        sig, wincx);
-+        } else {
-+            sigLen = checkedSignatureLen(key);
-+            /* Check signature length is within limits */
-+            if (sigLen == 0) {
-+                /* error set by checkedSignatureLen */
-+                rv = SECFailure;
-+                goto loser;
-+            }
-+            if (sigLen > sizeof(cx->u)) {
-+                PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
-+                rv = SECFailure;
-+                goto loser;
-+            }
-+            switch (type) {
-+                case rsaPssKey:
-+                    if (sig->len != sigLen) {
-+                        PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
-+                        rv = SECFailure;
-+                        goto loser;
-+                    }
-+                    PORT_Memcpy(cx->u.buffer, sig->data, sigLen);
-+                    rv = SECSuccess;
-                     break;
--                }
--                if (sig->len != sigLen) {
--                    PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
-+                case ecKey:
-+                case dsaKey:
-+                    /* decodeECorDSASignature will check sigLen == sig->len after padding */
-+                    rv = decodeECorDSASignature(encAlg, sig, cx->u.buffer, sigLen);
-+                    break;
-+                default:
-+                    /* Unreachable */
-                     rv = SECFailure;
--                    break;
--                }
--                PORT_Memcpy(cx->u.buffer, sig->data, sigLen);
--                break;
--            case dsaKey:
--            case ecKey:
--                sigLen = SECKEY_SignatureLen(key);
--                if (sigLen == 0) {
--                    /* error set by SECKEY_SignatureLen */
--                    rv = SECFailure;
--                    break;
--                }
--                rv = decodeECorDSASignature(encAlg, sig, cx->u.buffer, sigLen);
--                break;
--            default:
--                rv = SECFailure;
--                PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG);
--                break;
-+                    goto loser;
-+            }
-+        }
-+        if (rv != SECSuccess) {
-+            goto loser;
-         }
-     }
- 
--    if (rv)
--        goto loser;
--
-     /* check hash alg again, RSA may have changed it.*/
-     if (HASH_GetHashTypeByOidTag(cx->hashAlg) == HASH_AlgNULL) {
-         /* error set by HASH_GetHashTypeByOidTag */
-@@ -650,11 +685,16 @@
-     switch (cx->key->keyType) {
-         case ecKey:
-         case dsaKey:
--            dsasig.data = cx->u.buffer;
--            dsasig.len = SECKEY_SignatureLen(cx->key);
-+            dsasig.len = checkedSignatureLen(cx->key);
-             if (dsasig.len == 0) {
-                 return SECFailure;
-             }
-+            if (dsasig.len > sizeof(cx->u)) {
-+                PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
-+                return SECFailure;
-+            }
-+            dsasig.data = cx->u.buffer;
-+
-             if (sig) {
-                 rv = decodeECorDSASignature(cx->encAlg, sig, dsasig.data,
-                                             dsasig.len);
-@@ -686,8 +726,13 @@
-                 }
- 
-                 rsasig.data = cx->u.buffer;
--                rsasig.len = SECKEY_SignatureLen(cx->key);
-+                rsasig.len = checkedSignatureLen(cx->key);
-                 if (rsasig.len == 0) {
-+                    /* Error set by checkedSignatureLen */
-+                    return SECFailure;
-+                }
-+                if (rsasig.len > sizeof(cx->u)) {
-+                    PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
-                     return SECFailure;
-                 }
-                 if (sig) {
-@@ -749,7 +794,6 @@
-     SECStatus rv;
-     VFYContext *cx;
-     SECItem dsasig; /* also used for ECDSA */
--
-     rv = SECFailure;
- 
-     cx = vfy_CreateContext(key, sig, encAlg, hashAlg, NULL, wincx);
-@@ -757,19 +801,25 @@
-         switch (key->keyType) {
-             case rsaKey:
-                 rv = verifyPKCS1DigestInfo(cx, digest);
-+                /* Error (if any) set by verifyPKCS1DigestInfo */
-                 break;
--            case dsaKey:
-             case ecKey:
-+            case dsaKey:
-                 dsasig.data = cx->u.buffer;
--                dsasig.len = SECKEY_SignatureLen(cx->key);
-+                dsasig.len = checkedSignatureLen(cx->key);
-                 if (dsasig.len == 0) {
-+                    /* Error set by checkedSignatureLen */
-+                    rv = SECFailure;
-                     break;
-                 }
--                if (PK11_Verify(cx->key, &dsasig, (SECItem *)digest, cx->wincx) !=
--                    SECSuccess) {
-+                if (dsasig.len > sizeof(cx->u)) {
-                     PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
--                } else {
--                    rv = SECSuccess;
-+                    rv = SECFailure;
-+                    break;
-+                }
-+                rv = PK11_Verify(cx->key, &dsasig, (SECItem *)digest, cx->wincx);
-+                if (rv != SECSuccess) {
-+                    PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
-                 }
-                 break;
-             default:
-
diff --git a/debian/patches/series b/debian/patches/series
index 64788bc..bac12de 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -7,4 +7,3 @@ disable_fips_enabled_read.patch
 set-tls1.2-as-minimum.patch
 fix-ftbfs-s390x.patch
 fix-ftbfs-glibc-invalid-oob-error.patch
-CVE-2021-43527.patch
diff --git a/nss/.hg_archival.txt b/nss/.hg_archival.txt
index 9a2c8a2..807d9fe 100644
--- a/nss/.hg_archival.txt
+++ b/nss/.hg_archival.txt
@@ -1,4 +1,4 @@
 repo: 9949429068caa6bb8827a8ceeaa7c605d722f47f
-node: 3680dc580194cbe3bb1004d2f7741eebc3066d2c
-branch: NSS_3_68_BRANCH
-tag: NSS_3_68_RTM
+node: 78d2f4a3339fa41c274c5ea189f8060da9d3a463
+branch: NSS_3_68_2_BRANCH
+tag: NSS_3_68_2_RTM
diff --git a/nss/gtests/certdb_gtest/decode_certs_unittest.cc b/nss/gtests/certdb_gtest/decode_certs_unittest.cc
index 405194e..3317ae8 100644
--- a/nss/gtests/certdb_gtest/decode_certs_unittest.cc
+++ b/nss/gtests/certdb_gtest/decode_certs_unittest.cc
@@ -26,3 +26,16 @@ TEST_F(DecodeCertsTest, EmptyCertPackage) {
                          sizeof(emptyCertPackage)));
   EXPECT_EQ(SEC_ERROR_BAD_DER, PR_GetError());
 }
+
+TEST_F(DecodeCertsTest, EmptySignedData) {
+  // This represents a PKCS#7 ContentInfo of contentType
+  // 1.2.840.113549.1.7.2 (signedData) with missing content.
+  unsigned char emptySignedData[] = {0x30, 0x80, 0x06, 0x09, 0x2a, 0x86,
+                                     0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07,
+                                     0x02, 0x00, 0x00, 0x05, 0x00};
+
+  EXPECT_EQ(nullptr,
+            CERT_DecodeCertFromPackage(reinterpret_cast<char*>(emptySignedData),
+                                       sizeof(emptySignedData)));
+  EXPECT_EQ(SEC_ERROR_BAD_DER, PR_GetError());
+}
diff --git a/nss/gtests/mozpkix_gtest/pkixocsp_VerifyEncodedOCSPResponse.cpp b/nss/gtests/mozpkix_gtest/pkixocsp_VerifyEncodedOCSPResponse.cpp
index 58336df..c7e8236 100644
--- a/nss/gtests/mozpkix_gtest/pkixocsp_VerifyEncodedOCSPResponse.cpp
+++ b/nss/gtests/mozpkix_gtest/pkixocsp_VerifyEncodedOCSPResponse.cpp
@@ -217,9 +217,13 @@ public:
                     const TestSignatureAlgorithm& signatureAlgorithm,
        /*optional*/ const ByteString* certs = nullptr,
        /*optional*/ OCSPResponseExtension* singleExtensions = nullptr,
-       /*optional*/ OCSPResponseExtension* responseExtensions = nullptr)
+       /*optional*/ OCSPResponseExtension* responseExtensions = nullptr,
+       /*optional*/ DigestAlgorithm certIDHashAlgorithm = DigestAlgorithm::sha1,
+       /*optional*/ ByteString certIDHashAlgorithmEncoded = ByteString())
   {
     OCSPResponseContext context(certID, producedAt);
+    context.certIDHashAlgorithm = certIDHashAlgorithm;
+    context.certIDHashAlgorithmEncoded = certIDHashAlgorithmEncoded;
     if (signerName) {
       context.signerNameDER = CNToDERName(signerName);
       EXPECT_FALSE(ENCODING_FAILED(context.signerNameDER));
@@ -466,6 +470,72 @@ TEST_F(pkixocsp_VerifyEncodedResponse_successful, ct_extension)
             trustDomain.signedCertificateTimestamps);
 }
 
+struct CertIDHashAlgorithm
+{
+  DigestAlgorithm hashAlgorithm;
+  ByteString encodedHashAlgorithm;
+  Result expectedResult;
+};
+
+// python DottedOIDToCode.py --alg id-sha1 1.3.14.3.2.26
+static const uint8_t alg_id_sha1[] = {
+  0x30, 0x07, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a
+};
+// python DottedOIDToCode.py --alg id-sha256 2.16.840.1.101.3.4.2.1
+static const uint8_t alg_id_sha256[] = {
+  0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01
+};
+static const uint8_t not_an_encoded_hash_oid[] = {
+  0x01, 0x02, 0x03, 0x04
+};
+
+static const CertIDHashAlgorithm CERTID_HASH_ALGORITHMS[] = {
+  { DigestAlgorithm::sha1, ByteString(), Success },
+  { DigestAlgorithm::sha256, ByteString(), Success },
+  { DigestAlgorithm::sha384, ByteString(), Success },
+  { DigestAlgorithm::sha512, ByteString(), Success },
+  { DigestAlgorithm::sha256, BytesToByteString(alg_id_sha1),
+    Result::ERROR_OCSP_MALFORMED_RESPONSE },
+  { DigestAlgorithm::sha1, BytesToByteString(alg_id_sha256),
+    Result::ERROR_OCSP_MALFORMED_RESPONSE },
+  { DigestAlgorithm::sha1, BytesToByteString(not_an_encoded_hash_oid),
+    Result::ERROR_OCSP_MALFORMED_RESPONSE },
+};
+
+class pkixocsp_VerifyEncodedResponse_CertIDHashAlgorithm
+  : public pkixocsp_VerifyEncodedResponse_successful
+  , public ::testing::WithParamInterface<CertIDHashAlgorithm>
+{
+};
+
+TEST_P(pkixocsp_VerifyEncodedResponse_CertIDHashAlgorithm, CertIDHashAlgorithm)
+{
+  ByteString responseString(
+               CreateEncodedOCSPSuccessfulResponse(
+                         OCSPResponseContext::good, *endEntityCertID, byKey,
+                         *rootKeyPair, oneDayBeforeNow,
+                         oneDayBeforeNow, &oneDayAfterNow,
+                         sha256WithRSAEncryption(),
+                         nullptr,
+                         nullptr,
+                         nullptr,
+                         GetParam().hashAlgorithm,
+                         GetParam().encodedHashAlgorithm));
+  Input response;
+  ASSERT_EQ(Success,
+            response.Init(responseString.data(), responseString.length()));
+  bool expired;
+  ASSERT_EQ(GetParam().expectedResult,
+            VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID,
+                                      Now(), END_ENTITY_MAX_LIFETIME_IN_DAYS,
+                                      response, expired));
+  ASSERT_FALSE(expired);
+}
+
+INSTANTIATE_TEST_SUITE_P(pkixocsp_VerifyEncodedResponse_CertIDHashAlgorithm,
+                        pkixocsp_VerifyEncodedResponse_CertIDHashAlgorithm,
+                        testing::ValuesIn(CERTID_HASH_ALGORITHMS));
+
 ///////////////////////////////////////////////////////////////////////////////
 // indirect responses (signed by a delegated OCSP responder cert)
 
diff --git a/nss/lib/cryptohi/secvfy.c b/nss/lib/cryptohi/secvfy.c
index 2540a54..1754584 100644
--- a/nss/lib/cryptohi/secvfy.c
+++ b/nss/lib/cryptohi/secvfy.c
@@ -164,6 +164,37 @@ verifyPKCS1DigestInfo(const VFYContext *cx, const SECItem *digest)
         PR_FALSE /*XXX: unsafeAllowMissingParameters*/);
 }
 
+static unsigned int
+checkedSignatureLen(const SECKEYPublicKey *pubk)
+{
+    unsigned int sigLen = SECKEY_SignatureLen(pubk);
+    if (sigLen == 0) {
+        /* Error set by SECKEY_SignatureLen */
+        return sigLen;
+    }
+    unsigned int maxSigLen;
+    switch (pubk->keyType) {
+        case rsaKey:
+        case rsaPssKey:
+            maxSigLen = (RSA_MAX_MODULUS_BITS + 7) / 8;
+            break;
+        case dsaKey:
+            maxSigLen = DSA_MAX_SIGNATURE_LEN;
+            break;
+        case ecKey:
+            maxSigLen = 2 * MAX_ECKEY_LEN;
+            break;
+        default:
+            PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG);
+            return 0;
+    }
+    if (sigLen > maxSigLen) {
+        PORT_SetError(SEC_ERROR_INVALID_KEY);
+        return 0;
+    }
+    return sigLen;
+}
+
 /*
  * decode the ECDSA or DSA signature from it's DER wrapping.
  * The unwrapped/raw signature is placed in the buffer pointed
@@ -174,38 +205,38 @@ decodeECorDSASignature(SECOidTag algid, const SECItem *sig, unsigned char *dsig,
                        unsigned int len)
 {
     SECItem *dsasig = NULL; /* also used for ECDSA */
-    SECStatus rv = SECSuccess;
 
-    if ((algid != SEC_OID_ANSIX9_DSA_SIGNATURE) &&
-        (algid != SEC_OID_ANSIX962_EC_PUBLIC_KEY)) {
-        if (sig->len != len) {
-            PORT_SetError(SEC_ERROR_BAD_DER);
-            return SECFailure;
+    /* Safety: Ensure algId is as expected and that signature size is within maxmimums */
+    if (algid == SEC_OID_ANSIX9_DSA_SIGNATURE) {
+        if (len > DSA_MAX_SIGNATURE_LEN) {
+            goto loser;
         }
-
-        PORT_Memcpy(dsig, sig->data, sig->len);
-        return SECSuccess;
-    }
-
-    if (algid == SEC_OID_ANSIX962_EC_PUBLIC_KEY) {
+    } else if (algid == SEC_OID_ANSIX962_EC_PUBLIC_KEY) {
         if (len > MAX_ECKEY_LEN * 2) {
-            PORT_SetError(SEC_ERROR_BAD_DER);
-            return SECFailure;
+            goto loser;
         }
-    }
-    dsasig = DSAU_DecodeDerSigToLen((SECItem *)sig, len);
-
-    if ((dsasig == NULL) || (dsasig->len != len)) {
-        rv = SECFailure;
     } else {
-        PORT_Memcpy(dsig, dsasig->data, dsasig->len);
+        goto loser;
     }
 
-    if (dsasig != NULL)
+    /* Decode and pad to length */
+    dsasig = DSAU_DecodeDerSigToLen((SECItem *)sig, len);
+    if (dsasig == NULL) {
+        goto loser;
+    }
+    if (dsasig->len != len) {
         SECITEM_FreeItem(dsasig, PR_TRUE);
-    if (rv == SECFailure)
-        PORT_SetError(SEC_ERROR_BAD_DER);
-    return rv;
+        goto loser;
+    }
+
+    PORT_Memcpy(dsig, dsasig->data, len);
+    SECITEM_FreeItem(dsasig, PR_TRUE);
+
+    return SECSuccess;
+
+loser:
+    PORT_SetError(SEC_ERROR_BAD_DER);
+    return SECFailure;
 }
 
 const SEC_ASN1Template hashParameterTemplate[] =
@@ -281,7 +312,7 @@ SECStatus
 sec_DecodeSigAlg(const SECKEYPublicKey *key, SECOidTag sigAlg,
                  const SECItem *param, SECOidTag *encalgp, SECOidTag *hashalg)
 {
-    int len;
+    unsigned int len;
     PLArenaPool *arena;
     SECStatus rv;
     SECItem oid;
@@ -466,48 +497,52 @@ vfy_CreateContext(const SECKEYPublicKey *key, const SECItem *sig,
     cx->pkcs1RSADigestInfo = NULL;
     rv = SECSuccess;
     if (sig) {
-        switch (type) {
-            case rsaKey:
-                rv = recoverPKCS1DigestInfo(hashAlg, &cx->hashAlg,
-                                            &cx->pkcs1RSADigestInfo,
-                                            &cx->pkcs1RSADigestInfoLen,
-                                            cx->key,
-                                            sig, wincx);
-                break;
-            case rsaPssKey:
-                sigLen = SECKEY_SignatureLen(key);
-                if (sigLen == 0) {
-                    /* error set by SECKEY_SignatureLen */
-                    rv = SECFailure;
+        rv = SECFailure;
+        if (type == rsaKey) {
+            rv = recoverPKCS1DigestInfo(hashAlg, &cx->hashAlg,
+                                        &cx->pkcs1RSADigestInfo,
+                                        &cx->pkcs1RSADigestInfoLen,
+                                        cx->key,
+                                        sig, wincx);
+        } else {
+            sigLen = checkedSignatureLen(key);
+            /* Check signature length is within limits */
+            if (sigLen == 0) {
+                /* error set by checkedSignatureLen */
+                rv = SECFailure;
+                goto loser;
+            }
+            if (sigLen > sizeof(cx->u)) {
+                PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
+                rv = SECFailure;
+                goto loser;
+            }
+            switch (type) {
+                case rsaPssKey:
+                    if (sig->len != sigLen) {
+                        PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
+                        rv = SECFailure;
+                        goto loser;
+                    }
+                    PORT_Memcpy(cx->u.buffer, sig->data, sigLen);
+                    rv = SECSuccess;
                     break;
-                }
-                if (sig->len != sigLen) {
-                    PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
-                    rv = SECFailure;
+                case ecKey:
+                case dsaKey:
+                    /* decodeECorDSASignature will check sigLen == sig->len after padding */
+                    rv = decodeECorDSASignature(encAlg, sig, cx->u.buffer, sigLen);
                     break;
-                }
-                PORT_Memcpy(cx->u.buffer, sig->data, sigLen);
-                break;
-            case dsaKey:
-            case ecKey:
-                sigLen = SECKEY_SignatureLen(key);
-                if (sigLen == 0) {
-                    /* error set by SECKEY_SignatureLen */
+                default:
+                    /* Unreachable */
                     rv = SECFailure;
-                    break;
-                }
-                rv = decodeECorDSASignature(encAlg, sig, cx->u.buffer, sigLen);
-                break;
-            default:
-                rv = SECFailure;
-                PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG);
-                break;
+                    goto loser;
+            }
+        }
+        if (rv != SECSuccess) {
+            goto loser;
         }
     }
 
-    if (rv)
-        goto loser;
-
     /* check hash alg again, RSA may have changed it.*/
     if (HASH_GetHashTypeByOidTag(cx->hashAlg) == HASH_AlgNULL) {
         /* error set by HASH_GetHashTypeByOidTag */
@@ -650,11 +685,16 @@ VFY_EndWithSignature(VFYContext *cx, SECItem *sig)
     switch (cx->key->keyType) {
         case ecKey:
         case dsaKey:
-            dsasig.data = cx->u.buffer;
-            dsasig.len = SECKEY_SignatureLen(cx->key);
+            dsasig.len = checkedSignatureLen(cx->key);
             if (dsasig.len == 0) {
                 return SECFailure;
             }
+            if (dsasig.len > sizeof(cx->u)) {
+                PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
+                return SECFailure;
+            }
+            dsasig.data = cx->u.buffer;
+
             if (sig) {
                 rv = decodeECorDSASignature(cx->encAlg, sig, dsasig.data,
                                             dsasig.len);
@@ -686,8 +726,13 @@ VFY_EndWithSignature(VFYContext *cx, SECItem *sig)
                 }
 
                 rsasig.data = cx->u.buffer;
-                rsasig.len = SECKEY_SignatureLen(cx->key);
+                rsasig.len = checkedSignatureLen(cx->key);
                 if (rsasig.len == 0) {
+                    /* Error set by checkedSignatureLen */
+                    return SECFailure;
+                }
+                if (rsasig.len > sizeof(cx->u)) {
+                    PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
                     return SECFailure;
                 }
                 if (sig) {
@@ -749,7 +794,6 @@ vfy_VerifyDigest(const SECItem *digest, const SECKEYPublicKey *key,
     SECStatus rv;
     VFYContext *cx;
     SECItem dsasig; /* also used for ECDSA */
-
     rv = SECFailure;
 
     cx = vfy_CreateContext(key, sig, encAlg, hashAlg, NULL, wincx);
@@ -757,19 +801,25 @@ vfy_VerifyDigest(const SECItem *digest, const SECKEYPublicKey *key,
         switch (key->keyType) {
             case rsaKey:
                 rv = verifyPKCS1DigestInfo(cx, digest);
+                /* Error (if any) set by verifyPKCS1DigestInfo */
                 break;
-            case dsaKey:
             case ecKey:
+            case dsaKey:
                 dsasig.data = cx->u.buffer;
-                dsasig.len = SECKEY_SignatureLen(cx->key);
+                dsasig.len = checkedSignatureLen(cx->key);
                 if (dsasig.len == 0) {
+                    /* Error set by checkedSignatureLen */
+                    rv = SECFailure;
                     break;
                 }
-                if (PK11_Verify(cx->key, &dsasig, (SECItem *)digest, cx->wincx) !=
-                    SECSuccess) {
+                if (dsasig.len > sizeof(cx->u)) {
+                    PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
+                    rv = SECFailure;
+                    break;
+                }
+                rv = PK11_Verify(cx->key, &dsasig, (SECItem *)digest, cx->wincx);
+                if (rv != SECSuccess) {
                     PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
-                } else {
-                    rv = SECSuccess;
                 }
                 break;
             default:
diff --git a/nss/lib/mozpkix/include/pkix-test/pkixtestutil.h b/nss/lib/mozpkix/include/pkix-test/pkixtestutil.h
index 55c4354..70c0fee 100644
--- a/nss/lib/mozpkix/include/pkix-test/pkixtestutil.h
+++ b/nss/lib/mozpkix/include/pkix-test/pkixtestutil.h
@@ -349,6 +349,14 @@ class OCSPResponseContext final {
   OCSPResponseContext(const CertID& certID, std::time_t time);
 
   const CertID& certID;
+  // What digest algorithm to use to produce issuerNameHash and issuerKeyHash.
+  // Defaults to sha1.
+  DigestAlgorithm certIDHashAlgorithm;
+  // If non-empty, the sequence of bytes to use for hashAlgorithm when encoding
+  // this response. If empty, the sequence of bytes corresponding to
+  // certIDHashAlgorithm will be used. Defaults to empty.
+  ByteString certIDHashAlgorithmEncoded;
+
   // TODO(bug 980538): add a way to specify what certificates are included.
 
   // The fields below are in the order that they appear in an OCSP response.
diff --git a/nss/lib/mozpkix/include/pkix/pkixutil.h b/nss/lib/mozpkix/include/pkix/pkixutil.h
index ca5b5a2..b224aa1 100644
--- a/nss/lib/mozpkix/include/pkix/pkixutil.h
+++ b/nss/lib/mozpkix/include/pkix/pkixutil.h
@@ -259,6 +259,20 @@ Result CheckSubjectPublicKeyInfo(Input subjectPublicKeyInfo,
 #else
 #error Unsupported compiler for MOZILLA_PKIX_UNREACHABLE_DEFAULT.
 #endif
+
+inline size_t DigestAlgorithmToSizeInBytes(DigestAlgorithm digestAlgorithm) {
+  switch (digestAlgorithm) {
+    case DigestAlgorithm::sha1:
+      return 160 / 8;
+    case DigestAlgorithm::sha256:
+      return 256 / 8;
+    case DigestAlgorithm::sha384:
+      return 384 / 8;
+    case DigestAlgorithm::sha512:
+      return 512 / 8;
+      MOZILLA_PKIX_UNREACHABLE_DEFAULT_ENUM
+  }
+}
 }
 }  // namespace mozilla::pkix
 
diff --git a/nss/lib/mozpkix/lib/pkixocsp.cpp b/nss/lib/mozpkix/lib/pkixocsp.cpp
index a811544..d725e55 100644
--- a/nss/lib/mozpkix/lib/pkixocsp.cpp
+++ b/nss/lib/mozpkix/lib/pkixocsp.cpp
@@ -28,12 +28,6 @@
 #include "mozpkix/pkixcheck.h"
 #include "mozpkix/pkixutil.h"
 
-namespace {
-
-const size_t SHA1_DIGEST_LENGTH = 160 / 8;
-
-} // namespace
-
 namespace mozilla { namespace pkix {
 
 // These values correspond to the tag values in the ASN.1 CertStatus
@@ -181,10 +175,12 @@ static inline Result MatchCertID(Reader& input,
                                  const Context& context,
                                  /*out*/ bool& match);
 static Result MatchKeyHash(TrustDomain& trustDomain,
+                           DigestAlgorithm hashAlgorithm,
                            Input issuerKeyHash,
                            Input issuerSubjectPublicKeyInfo,
                            /*out*/ bool& match);
 static Result KeyHash(TrustDomain& trustDomain,
+                      DigestAlgorithm hashAlgorithm,
                       Input subjectPublicKeyInfo,
                       /*out*/ uint8_t* hashBuf, size_t hashBufSize);
 
@@ -213,7 +209,7 @@ MatchResponderID(TrustDomain& trustDomain,
       if (rv != Success) {
         return rv;
       }
-      return MatchKeyHash(trustDomain, keyHash,
+      return MatchKeyHash(trustDomain, DigestAlgorithm::sha1, keyHash,
                           potentialSignerSubjectPublicKeyInfo, match);
     }
 
@@ -741,36 +737,36 @@ MatchCertID(Reader& input, const Context& context, /*out*/ bool& match)
     return Success;
   }
 
-  // TODO: support SHA-2 hashes.
-
-  if (hashAlgorithm != DigestAlgorithm::sha1) {
-    // Again, not interested in this response. Consume input, return success.
-    input.SkipToEnd();
-    return Success;
-  }
-
-  if (issuerNameHash.GetLength() != SHA1_DIGEST_LENGTH) {
+  size_t hashAlgorithmLength = DigestAlgorithmToSizeInBytes(hashAlgorithm);
+  if (issuerNameHash.GetLength() != hashAlgorithmLength) {
     return Result::ERROR_OCSP_MALFORMED_RESPONSE;
   }
 
   // From http://tools.ietf.org/html/rfc6960#section-4.1.1:
   // "The hash shall be calculated over the DER encoding of the
   // issuer's name field in the certificate being checked."
-  uint8_t hashBuf[SHA1_DIGEST_LENGTH];
+  uint8_t hashBuf[MAX_DIGEST_SIZE_IN_BYTES];
+  if (hashAlgorithmLength > sizeof(hashBuf)) {
+    return Result::FATAL_ERROR_LIBRARY_FAILURE;
+  }
   rv = context.trustDomain.DigestBuf(context.certID.issuer,
-                                     DigestAlgorithm::sha1, hashBuf,
-                                     sizeof(hashBuf));
+                                     hashAlgorithm, hashBuf,
+                                     hashAlgorithmLength);
+  if (rv != Success) {
+    return rv;
+  }
+  Input computed;
+  rv = computed.Init(hashBuf, hashAlgorithmLength);
   if (rv != Success) {
     return rv;
   }
-  Input computed(hashBuf);
   if (!InputsAreEqual(computed, issuerNameHash)) {
     // Again, not interested in this response. Consume input, return success.
     input.SkipToEnd();
     return Success;
   }
 
-  return MatchKeyHash(context.trustDomain, issuerKeyHash,
+  return MatchKeyHash(context.trustDomain, hashAlgorithm, issuerKeyHash,
                       context.certID.issuerSubjectPublicKeyInfo, match);
 }
 
@@ -784,30 +780,53 @@ MatchCertID(Reader& input, const Context& context, /*out*/ bool& match)
 //                          -- BIT STRING subjectPublicKey [excluding
 //                          -- the tag, length, and number of unused
 //                          -- bits] in the responder's certificate)
+//
+// From https://datatracker.ietf.org/doc/html/rfc6960#section-4.1.1:
+//    CertID          ::=     SEQUENCE {
+//        hashAlgorithm       AlgorithmIdentifier,
+//        issuerNameHash      OCTET STRING, -- Hash of issuer's DN
+//        issuerKeyHash       OCTET STRING, -- Hash of issuer's public key
+//        serialNumber        CertificateSerialNumber }
+// ...
+//    o  hashAlgorithm is the hash algorithm used to generate the
+//       issuerNameHash and issuerKeyHash values.
+// ...
+//    o  issuerKeyHash is the hash of the issuer's public key.  The hash
+//       shall be calculated over the value (excluding tag and length) of
+//       the subject public key field in the issuer's certificate.
 static Result
-MatchKeyHash(TrustDomain& trustDomain, Input keyHash,
-             const Input subjectPublicKeyInfo, /*out*/ bool& match)
+MatchKeyHash(TrustDomain& trustDomain, DigestAlgorithm hashAlgorithm,
+             Input keyHash, const Input subjectPublicKeyInfo,
+             /*out*/ bool& match)
 {
-  if (keyHash.GetLength() != SHA1_DIGEST_LENGTH)  {
+  size_t hashLength = DigestAlgorithmToSizeInBytes(hashAlgorithm);
+  if (keyHash.GetLength() != hashLength)  {
     return Result::ERROR_OCSP_MALFORMED_RESPONSE;
   }
-  uint8_t hashBuf[SHA1_DIGEST_LENGTH];
-  Result rv = KeyHash(trustDomain, subjectPublicKeyInfo, hashBuf,
-                      sizeof hashBuf);
+  uint8_t hashBuf[MAX_DIGEST_SIZE_IN_BYTES];
+  if (hashLength > MAX_DIGEST_SIZE_IN_BYTES) {
+    return Result::FATAL_ERROR_LIBRARY_FAILURE;
+  }
+  Result rv = KeyHash(trustDomain, hashAlgorithm, subjectPublicKeyInfo,
+                      hashBuf, hashLength);
+  if (rv != Success) {
+    return rv;
+  }
+  Input computed;
+  rv = computed.Init(hashBuf, hashLength);
   if (rv != Success) {
     return rv;
   }
-  Input computed(hashBuf);
   match = InputsAreEqual(computed, keyHash);
   return Success;
 }
 
-// TODO(bug 966856): support SHA-2 hashes
 Result
-KeyHash(TrustDomain& trustDomain, const Input subjectPublicKeyInfo,
-        /*out*/ uint8_t* hashBuf, size_t hashBufSize)
+KeyHash(TrustDomain& trustDomain, DigestAlgorithm hashAlgorithm,
+        const Input subjectPublicKeyInfo, /*out*/ uint8_t* hashBuf,
+        size_t hashBufSize)
 {
-  if (!hashBuf || hashBufSize != SHA1_DIGEST_LENGTH) {
+  if (!hashBuf || hashBufSize != DigestAlgorithmToSizeInBytes(hashAlgorithm)) {
     return Result::FATAL_ERROR_LIBRARY_FAILURE;
   }
 
@@ -840,8 +859,8 @@ KeyHash(TrustDomain& trustDomain, const Input subjectPublicKeyInfo,
     return rv;
   }
 
-  return trustDomain.DigestBuf(subjectPublicKey, DigestAlgorithm::sha1,
-                               hashBuf, hashBufSize);
+  return trustDomain.DigestBuf(subjectPublicKey, hashAlgorithm, hashBuf,
+                               hashBufSize);
 }
 
 Result
@@ -921,8 +940,6 @@ CreateEncodedOCSPRequest(TrustDomain& trustDomain, const struct CertID& certID,
   // and thus more likely to fit within the 255 byte limit for OCSP GET that
   // is specified in RFC 5019 Section 5.
 
-  // Bug 966856: Add the id-pkix-ocsp-pref-sig-algs extension.
-
   // Since we don't know whether the OCSP responder supports anything other
   // than SHA-1, we have no choice but to use SHA-1 for issuerNameHash and
   // issuerKeyHash.
@@ -986,7 +1003,8 @@ CreateEncodedOCSPRequest(TrustDomain& trustDomain, const struct CertID& certID,
   // reqCert.issuerKeyHash (OCTET STRING)
   *d++ = 0x04;
   *d++ = hashLen;
-  rv = KeyHash(trustDomain, certID.issuerSubjectPublicKeyInfo, d, hashLen);
+  rv = KeyHash(trustDomain, DigestAlgorithm::sha1,
+               certID.issuerSubjectPublicKeyInfo, d, hashLen);
   if (rv != Success) {
     return rv;
   }
diff --git a/nss/lib/mozpkix/lib/pkixverify.cpp b/nss/lib/mozpkix/lib/pkixverify.cpp
index 8ceb2c1..bec570d 100644
--- a/nss/lib/mozpkix/lib/pkixverify.cpp
+++ b/nss/lib/mozpkix/lib/pkixverify.cpp
@@ -43,14 +43,7 @@ DigestSignedData(TrustDomain& trustDomain,
     return Result::ERROR_BAD_DER;
   }
 
-  size_t digestLen;
-  switch (signedDigest.digestAlgorithm) {
-    case DigestAlgorithm::sha512: digestLen = 512 / 8; break;
-    case DigestAlgorithm::sha384: digestLen = 384 / 8; break;
-    case DigestAlgorithm::sha256: digestLen = 256 / 8; break;
-    case DigestAlgorithm::sha1: digestLen = 160 / 8; break;
-    MOZILLA_PKIX_UNREACHABLE_DEFAULT_ENUM
-  }
+  size_t digestLen = DigestAlgorithmToSizeInBytes(signedDigest.digestAlgorithm);
   assert(digestLen <= sizeof(digestBuf));
 
   rv = trustDomain.DigestBuf(signedData.data, signedDigest.digestAlgorithm,
diff --git a/nss/lib/mozpkix/test-lib/pkixtestutil.cpp b/nss/lib/mozpkix/test-lib/pkixtestutil.cpp
index b1b89c0..306f7a0 100644
--- a/nss/lib/mozpkix/test-lib/pkixtestutil.cpp
+++ b/nss/lib/mozpkix/test-lib/pkixtestutil.cpp
@@ -156,6 +156,8 @@ OCSPResponseExtension::OCSPResponseExtension()
 
 OCSPResponseContext::OCSPResponseContext(const CertID& aCertID, time_t time)
   : certID(aCertID)
+  , certIDHashAlgorithm(DigestAlgorithm::sha1)
+  , certIDHashAlgorithmEncoded(ByteString())
   , responseStatus(successful)
   , skipResponseBytes(false)
   , producedAt(time)
@@ -184,25 +186,26 @@ static ByteString CertID(OCSPResponseContext& context);
 static ByteString CertStatus(OCSPResponseContext& context);
 
 static ByteString
-SHA1(const ByteString& toHash)
+HASH(const ByteString& toHash, DigestAlgorithm digestAlgorithm)
 {
-  uint8_t digestBuf[20];
+  uint8_t digestBuf[MAX_DIGEST_SIZE_IN_BYTES];
   Input input;
   if (input.Init(toHash.data(), toHash.length()) != Success) {
     abort();
   }
-  Result rv = TestDigestBuf(input, DigestAlgorithm::sha1, digestBuf,
-                            sizeof(digestBuf));
+  size_t digestLen = DigestAlgorithmToSizeInBytes(digestAlgorithm);
+  assert(digestLen <= sizeof(digestBuf));
+  Result rv = TestDigestBuf(input, digestAlgorithm, digestBuf, digestLen);
   if (rv != Success) {
     abort();
   }
-  return ByteString(digestBuf, sizeof(digestBuf));
+  return ByteString(digestBuf, digestLen);
 }
 
 static ByteString
-HashedOctetString(const ByteString& bytes)
+HashedOctetString(const ByteString& bytes, DigestAlgorithm digestAlgorithm)
 {
-  ByteString digest(SHA1(bytes));
+  ByteString digest(HASH(bytes, digestAlgorithm));
   if (ENCODING_FAILED(digest)) {
     return ByteString();
   }
@@ -993,7 +996,7 @@ ResponderID(OCSPResponseContext& context)
 ByteString
 KeyHash(const ByteString& subjectPublicKey)
 {
-  return HashedOctetString(subjectPublicKey);
+  return HashedOctetString(subjectPublicKey, DigestAlgorithm::sha1);
 }
 
 // SingleResponse ::= SEQUENCE {
@@ -1050,7 +1053,7 @@ CertID(OCSPResponseContext& context)
 {
   ByteString issuerName(context.certID.issuer.UnsafeGetData(),
                         context.certID.issuer.GetLength());
-  ByteString issuerNameHash(HashedOctetString(issuerName));
+  ByteString issuerNameHash(HashedOctetString(issuerName, context.certIDHashAlgorithm));
   if (ENCODING_FAILED(issuerNameHash)) {
     return ByteString();
   }
@@ -1074,8 +1077,8 @@ CertID(OCSPResponseContext& context)
           != Success) {
       return ByteString();
     }
-    issuerKeyHash = KeyHash(ByteString(subjectPublicKey.UnsafeGetData(),
-                                       subjectPublicKey.GetLength()));
+    issuerKeyHash = HashedOctetString(ByteString(subjectPublicKey.UnsafeGetData(),
+        subjectPublicKey.GetLength()), context.certIDHashAlgorithm);
     if (ENCODING_FAILED(issuerKeyHash)) {
       return ByteString();
     }
@@ -1089,9 +1092,39 @@ CertID(OCSPResponseContext& context)
   static const uint8_t alg_id_sha1[] = {
     0x30, 0x07, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a
   };
+  // python DottedOIDToCode.py --alg id-sha256 2.16.840.1.101.3.4.2.1
+  static const uint8_t alg_id_sha256[] = {
+    0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01
+  };
+  // python DottedOIDToCode.py --alg id-sha384 2.16.840.1.101.3.4.2.2
+  static const uint8_t alg_id_sha384[] = {
+    0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02
+  };
+  // python DottedOIDToCode.py --alg id-sha512 2.16.840.1.101.3.4.2.3
+  static const uint8_t alg_id_sha512[] = {
+    0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03
+  };
 
   ByteString value;
-  value.append(alg_id_sha1, sizeof(alg_id_sha1));
+  if (!context.certIDHashAlgorithmEncoded.empty()) {
+    value.append(context.certIDHashAlgorithmEncoded);
+  } else {
+    switch (context.certIDHashAlgorithm) {
+      case DigestAlgorithm::sha1:
+        value.append(alg_id_sha1, sizeof(alg_id_sha1));
+        break;
+      case DigestAlgorithm::sha256:
+        value.append(alg_id_sha256, sizeof(alg_id_sha256));
+        break;
+      case DigestAlgorithm::sha384:
+        value.append(alg_id_sha384, sizeof(alg_id_sha384));
+        break;
+      case DigestAlgorithm::sha512:
+        value.append(alg_id_sha512, sizeof(alg_id_sha512));
+        break;
+      MOZILLA_PKIX_UNREACHABLE_DEFAULT_ENUM
+    }
+  }
   value.append(issuerNameHash);
   value.append(issuerKeyHash);
   value.append(serialNumber);
diff --git a/nss/lib/nss/nss.h b/nss/lib/nss/nss.h
index 5d372e7..c87fa1e 100644
--- a/nss/lib/nss/nss.h
+++ b/nss/lib/nss/nss.h
@@ -22,10 +22,10 @@
  * The format of the version string should be
  *     "<major version>.<minor version>[.<patch level>[.<build number>]][ <ECC>][ <Beta>]"
  */
-#define NSS_VERSION "3.68" _NSS_CUSTOMIZED
+#define NSS_VERSION "3.68.2" _NSS_CUSTOMIZED
 #define NSS_VMAJOR 3
 #define NSS_VMINOR 68
-#define NSS_VPATCH 0
+#define NSS_VPATCH 2
 #define NSS_VBUILD 0
 #define NSS_BETA PR_FALSE
 
diff --git a/nss/lib/pkcs7/certread.c b/nss/lib/pkcs7/certread.c
index 3091f99..15094f2 100644
--- a/nss/lib/pkcs7/certread.c
+++ b/nss/lib/pkcs7/certread.c
@@ -139,6 +139,11 @@ SEC_ReadPKCS7Certs(SECItem *pkcs7Item, CERTImportCertificateFunc f, void *arg)
         goto done;
     }
 
+    if (contentInfo.content.signedData == NULL) {
+        PORT_SetError(SEC_ERROR_BAD_DER);
+        goto done;
+    }
+
     rv = SECSuccess;
 
     certs = contentInfo.content.signedData->certificates;
diff --git a/nss/lib/softoken/softkver.h b/nss/lib/softoken/softkver.h
index 349373e..f3506b6 100644
--- a/nss/lib/softoken/softkver.h
+++ b/nss/lib/softoken/softkver.h
@@ -17,10 +17,10 @@
  * The format of the version string should be
  *     "<major version>.<minor version>[.<patch level>[.<build number>]][ <ECC>][ <Beta>]"
  */
-#define SOFTOKEN_VERSION "3.68" SOFTOKEN_ECC_STRING
+#define SOFTOKEN_VERSION "3.68.2" SOFTOKEN_ECC_STRING
 #define SOFTOKEN_VMAJOR 3
 #define SOFTOKEN_VMINOR 68
-#define SOFTOKEN_VPATCH 0
+#define SOFTOKEN_VPATCH 2
 #define SOFTOKEN_VBUILD 0
 #define SOFTOKEN_BETA PR_FALSE
 
diff --git a/nss/lib/util/nssutil.h b/nss/lib/util/nssutil.h
index 21cdbf6..28e0f1e 100644
--- a/nss/lib/util/nssutil.h
+++ b/nss/lib/util/nssutil.h
@@ -19,10 +19,10 @@
  * The format of the version string should be
  *     "<major version>.<minor version>[.<patch level>[.<build number>]][ <Beta>]"
  */
-#define NSSUTIL_VERSION "3.68"
+#define NSSUTIL_VERSION "3.68.2"
 #define NSSUTIL_VMAJOR 3
 #define NSSUTIL_VMINOR 68
-#define NSSUTIL_VPATCH 0
+#define NSSUTIL_VPATCH 2
 #define NSSUTIL_VBUILD 0
 #define NSSUTIL_BETA PR_FALSE