Merge ~lucaskanashiro/ubuntu/+source/nss:focal-merge-3.49.1-1 into ubuntu/+source/nss:debian/sid

[Lucas Kanashiro]

Merge version 2:3.49.1-1 from Debian. This version fixes a FTBFS on armhf, here are the changes:

  * New upstream release.
  * nss/lib/freebl/Makefile: Revert change from 2:3.48-1.
  * nss/coreconf/config.gypi, nss/lib/freebl/Makefile,
    nss/lib/freebl/aes-armv8.c, nss/lib/freebl/freebl.gyp,
    nss/lib/freebl/gcm-arm32-neon.c, nss/lib/freebl/gcm.c,
    nss/lib/freebl/rijndael.c: Fix freebl arm NEON code use, fixing FTBFS
    on armhf, and enabling runtime detection of NEON on armel. bz#1608327
  * Fixes CVE-2019-17023.

Our delta kept the same:

    - d/libnss3.links: make freebl3 available as library (LP #1744328)
    - d/control: add dh-exec to Build-Depends
    - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
    - Disable reading fips_enabled flag in FIPS mode. libnss is
      not a FIPS certified library. (LP #1837734)
    - Set TLSv1.2 as minimum TLS version. LP #1856428

The package builds fine all architectures as you can see in my PPA:

https://launchpad.net/~lucaskanashiro/+archive/ubuntu/focal-nss-merge-3.49.1-1

[Andreas Hasenack (ahasenack)]

+1

[Andreas Hasenack (ahasenack)]

Tagging and uploading a9ecbd25eac7c9cc2eaec18d4cd7ea68b9a21f88:

$ git push pkg upload/2%3.49.1-1ubuntu1
Enumerating objects: 44, done.
Counting objects: 100% (44/44), done.
Delta compression using up to 4 threads
Compressing objects: 100% (25/25), done.
Writing objects: 100% (37/37), 6.71 KiB | 312.00 KiB/s, done.
Total 37 (delta 16), reused 30 (delta 12)
To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/nss
 * [new tag] upload/2%3.49.1-1ubuntu1 -> upload/2%3.49.1-1ubuntu1

$ dput ubuntu ../nss_3.49.1-1ubuntu1_source.changes
Checking signature on .changes
gpg: ../nss_3.49.1-1ubuntu1_source.changes: Valid signature from AC983EB5BF6BCBA9
Checking signature on .dsc
gpg: ../nss_3.49.1-1ubuntu1.dsc: Valid signature from AC983EB5BF6BCBA9
Package includes an .orig.tar.gz file although the debian revision suggests
that it might not be required. Multiple uploads of the .orig.tar.gz may be
rejected by the upload queue management software.
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading nss_3.49.1-1ubuntu1.dsc: done.
  Uploading nss_3.49.1.orig.tar.gz: done.
  Uploading nss_3.49.1-1ubuntu1.debian.tar.xz: done.
  Uploading nss_3.49.1-1ubuntu1_source.buildinfo: done.
  Uploading nss_3.49.1-1ubuntu1_source.changes: done.
Successfully uploaded packages.

Please check its migration, thanks.

[Andreas Hasenack (ahasenack)]

This migrated into focal.

diff --git a/debian/changelog b/debian/changelog
index b1db982..a004ef9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,15 @@
+nss (2:3.49.1-1ubuntu1) focal; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/libnss3.links: make freebl3 available as library (LP #1744328)
+    - d/control: add dh-exec to Build-Depends
+    - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+    - Disable reading fips_enabled flag in FIPS mode. libnss is
+      not a FIPS certified library. (LP #1837734)
+    - Set TLSv1.2 as minimum TLS version. LP #1856428
+
+ -- Lucas Kanashiro <[e-mail]>  Wed, 22 Jan 2020 16:24:44 -0300
+
 nss (2:3.49.1-1) unstable; urgency=medium
 
   * New upstream release.
@@ -17,6 +29,18 @@ nss (2:3.49-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Thu, 09 Jan 2020 13:46:11 +0900
 
+nss (2:3.48-1ubuntu1) focal; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - d/libnss3.links: make freebl3 available as library (LP #1744328)
+    - d/control: add dh-exec to Build-Depends
+    - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+    - Disable reading fips_enabled flag in FIPS mode. libnss is
+      not a FIPS certified library. (LP #1837734)
+  * Set TLSv1.2 as minimum TLS version. LP: #1856428
+
+ -- Ubuntu Merge-o-Matic <[e-mail]>  Sun, 29 Dec 2019 03:43:36 +0000
+
 nss (2:3.48-1) unstable; urgency=medium
 
   * New upstream release. Closes: #947131.
@@ -33,6 +57,26 @@ nss (2:3.47.1-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Wed, 04 Dec 2019 09:00:54 +0900
 
+nss (2:3.47-1ubuntu2) focal; urgency=medium
+
+  * SECURITY UPDATE: out-of-bounds write in NSC_EncryptUpdate
+    - debian/patches/CVE-2019-11745.patch: use maxout not block size in
+      nss/lib/softoken/pkcs11c.c.
+    - CVE-2019-11745
+
+ -- Marc Deslauriers <[e-mail]>  Tue, 26 Nov 2019 08:31:39 -0500
+
+nss (2:3.47-1ubuntu1) focal; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/libnss3.links: make freebl3 available as library (LP #1744328)
+    - d/control: add dh-exec to Build-Depends
+    - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+    - Disable reading fips_enabled flag in FIPS mode. libnss is
+      not a FIPS certified library. (LP #1837734)
+
+ -- Lucas Kanashiro <[e-mail]>  Thu, 31 Oct 2019 16:18:35 -0300
+
 nss (2:3.47-1) unstable; urgency=medium
 
   * New upstream release.
@@ -40,6 +84,22 @@ nss (2:3.47-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Wed, 23 Oct 2019 11:19:59 +0900
 
+nss (2:3.45-1ubuntu2) eoan; urgency=medium
+
+  * Disable reading fips_enabled flag in FIPS mode. libnss is
+    not a FIPS certified library. (LP: #1837734)
+
+ -- Vineetha Kamath <[e-mail]>  Tue, 23 Jul 2019 20:58:12 +0000
+
+nss (2:3.45-1ubuntu1) eoan; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - d/libnss3.links: make freebl3 available as library (LP 1744328)
+    - d/control: add dh-exec to Build-Depends
+    - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+
+ -- Gianfranco Costamagna <[e-mail]>  Thu, 11 Jul 2019 11:49:44 +0200
+
 nss (2:3.45-1) unstable; urgency=medium
 
   * New upstream release.
@@ -88,6 +148,28 @@ nss (2:3.42.1-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Wed, 13 Feb 2019 13:19:39 +0900
 
+nss (2:3.42-1ubuntu2) disco; urgency=medium
+
+  * SECURITY UPDATE: DoS in NULL pointer dereference in CMS functions
+    - debian/patches/CVE-2018-18508-1.patch: add null checks in
+      nss/lib/smime/cmscinfo.c, nss/lib/smime/cmsdigdata.c,
+      nss/lib/smime/cmsencdata.c, nss/lib/smime/cmsenvdata.c,
+      nss/lib/smime/cmsmessage.c, nss/lib/smime/cmsudf.c.
+    - debian/patches/CVE-2018-18508-2.patch: add null checks in
+      nss/lib/smime/cmsmessage.c.
+    - CVE-2018-18508
+
+ -- Marc Deslauriers <[e-mail]>  Tue, 19 Feb 2019 12:04:49 +0100
+
+nss (2:3.42-1ubuntu1) disco; urgency=medium
+
+  * Merge with Debian unstable (LP: #1813593). Remaining changes:
+    - d/libnss3.links: make freebl3 available as library (LP 1744328)
+    - d/control: add dh-exec to Build-Depends
+    - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+
+ -- Karl Stenerud <[e-mail]>  Mon, 04 Feb 2019 11:03:32 +0100
+
 nss (2:3.42-1) unstable; urgency=medium
 
   * New upstream release.
@@ -106,6 +188,18 @@ nss (2:3.40-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Fri, 02 Nov 2018 14:44:19 +0900
 
+nss (2:3.39-1ubuntu1) disco; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes (LP: #1803707):
+    - d/libnss3.links: make freebl3 available as library (LP 1744328)
+      - d/control: add dh-exec to Build-Depends
+      - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+  * Dropped changes:
+    - d/rules: when building with -O3 on ppc64el this FTBFS, build with
+      -Wno-error=maybe-uninitialized to avoid that
+
+ -- Christian Ehrhardt <[e-mail]>  Fri, 16 Nov 2018 14:27:39 +0100
+
 nss (2:3.39-1) unstable; urgency=medium
 
   * New upstream release.
@@ -138,6 +232,23 @@ nss (2:3.37-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Mon, 14 May 2018 07:15:21 +0900
 
+nss (2:3.36.1-1ubuntu1) cosmic; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/libnss3.links: make freebl3 available as library (LP 1744328)
+      - d/control: add dh-exec to Build-Depends
+      - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+    - d/rules: when building with -O3 on ppc64el this FTBFS, build with
+      -Wno-error=maybe-uninitialized to avoid that
+  * Dropped changes:
+    - revert switching to SQL default format (LP: 1746947) Dropping this
+      adresses (LP: #1747411) and effectively means we now switch to the new
+      default format after we ensured all depending packages are ready.
+  * Added changes:
+    - d/rules: extended the FTBFS to -O3 on ppc64el to only apply on ppc64el
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 07 May 2018 17:08:46 +0200
+
 nss (2:3.36.1-1) unstable; urgency=medium
 
   * New upstream release.
@@ -151,6 +262,25 @@ nss (2:3.36-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Sun, 08 Apr 2018 06:53:15 +0900
 
+nss (2:3.35-2ubuntu2) bionic; urgency=medium
+
+  * d/p/lp1746947-revert-switch-default-to-sql.patch: the switch of the
+    default is still causing too much issues in consumers of nss.
+    So until resolved revert the switched default (LP: #1746947)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 05 Feb 2018 11:36:07 +0100
+
+nss (2:3.35-2ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+  * Added Changes:
+    - d/libnss3.links: make freebl3 available as library (LP: #1744328)
+      + d/control: add dh-exec to Build-Depends
+      + d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 30 Jan 2018 14:04:20 +0100
+
 nss (2:3.35-2) unstable; urgency=medium
 
   * nss/lib/freebl/Makefile: Build Hacl_Poly1305_64.o on arm64.
@@ -169,6 +299,13 @@ nss (2:3.34.1-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Fri, 05 Jan 2018 20:15:40 +0900
 
+nss (2:3.34-1ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 14 Dec 2017 09:18:47 -0500
+
 nss (2:3.34-1) unstable; urgency=medium
 
   * New upstream release:
@@ -193,6 +330,28 @@ nss (2:3.32-2) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Mon, 28 Aug 2017 07:39:59 +0900
 
+nss (2:3.32-1ubuntu3) artful; urgency=medium
+
+  * SECURITY UPDATE: Use-after-free in TLS 1.2 generating handshake hashes
+    - debian/patches/CVE-2017-7805.patch: Simplify handling of
+      CertificateVerify in nss/lib/ssl/ssl3con.c, nss/lib/ssl/ssl3prot.h.
+    - CVE-2017-7805
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 29 Sep 2017 12:17:39 -0400
+
+nss (2:3.32-1ubuntu2) artful; urgency=medium
+
+  * Initialise curve variable in a test file, resolves FTBFS.
+
+ -- Dimitri John Ledkov <[e-mail]>  Thu, 24 Aug 2017 07:21:27 -0400
+
+nss (2:3.32-1ubuntu1) artful; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 23 Aug 2017 13:09:20 -0400
+
 nss (2:3.32-1) unstable; urgency=medium
 
   * New upstream release.
@@ -252,6 +411,39 @@ nss (2:3.27.1-1) experimental; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Sat, 19 Nov 2016 08:29:17 +0900
 
+nss (2:3.28.4-0ubuntu2) artful; urgency=medium
+
+  * SECURITY UPDATE: DoS via empty SSLv2 messages
+    - debian/patches/CVE-2017-7502.patch: reject broken v2 records in
+      nss/lib/ssl/ssl3gthr.c, nss/lib/ssl/ssldef.c, nss/lib/ssl/sslimpl.h,
+      added tests to nss/gtests/ssl_gtest/ssl_gather_unittest.cc,
+      nss/gtests/ssl_gtest/ssl_gtest.gyp, nss/gtests/ssl_gtest/manifest.mn,
+      nss/gtests/ssl_gtest/ssl_v2_client_hello_unittest.cc.
+    - CVE-2017-7502
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 16 Jun 2017 08:12:38 -0400
+
+nss (2:3.28.4-0ubuntu1) artful; urgency=medium
+
+  * Updated to upstream 3.28.4 to fix security issues and get a new CA
+    certificate bundle.
+  * SECURITY UPDATE: DES and Triple DES ciphers birthday attack
+    - CVE-2016-2183
+  * SECURITY UPDATE: out-of-bounds write in Base64 decoding
+    - CVE-2017-5461
+  * debian/patches/*.patch: refreshed for new version.
+  * debian/control: bump libnspr4-dev to 4.13.1.
+  * debian/libnss3.symbols: added new symbols.
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 27 Apr 2017 13:13:44 -0400
+
+nss (2:3.26.2-1ubuntu1) zesty; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 02 Dec 2016 08:48:03 -0500
+
 nss (2:3.26.2-1) unstable; urgency=medium
 
   * New upstream release.
@@ -265,6 +457,13 @@ nss (2:3.26-2) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Wed, 21 Sep 2016 10:02:23 +0900
 
+nss (2:3.26-1ubuntu1) yakkety; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Matthias Klose <[e-mail]>  Tue, 06 Sep 2016 14:39:56 +0200
+
 nss (2:3.26-1) unstable; urgency=medium
 
   * New upstream release.
@@ -279,6 +478,12 @@ nss (2:3.26-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Tue, 16 Aug 2016 16:33:15 +0900
 
+nss (2:3.25-1ubuntu1) yakkety; urgency=medium
+
+  * When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Matthias Klose <[e-mail]>  Thu, 04 Aug 2016 11:36:54 +0200
+
 nss (2:3.25-1) unstable; urgency=medium
 
   * New upstream release.
@@ -310,6 +515,7 @@ nss (2:3.21-1.1) unstable; urgency=medium
   * Fix FTBFS on hppa. Closes: #808990
 
  -- Adam Borowski <[e-mail]>  Sun, 14 Feb 2016 14:46:40 +0100
+
 nss (2:3.21-1) unstable; urgency=medium
 
   * New upstream release.
@@ -1225,3 +1431,4 @@ nss (3.11.5-1) experimental; urgency=low
   * Initial release. (Closes: #416151)
 
  -- Mike Hommey <[e-mail]>  Sun, 25 Mar 2007 23:56:17 +0200
+
diff --git a/debian/control b/debian/control
index a4be555..ac713a6 100644
--- a/debian/control
+++ b/debian/control
@@ -1,9 +1,11 @@
 Source: nss
 Section: libs
 Priority: optional
-Maintainer: Maintainers of Mozilla-related packages <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Maintainers of Mozilla-related packages <[e-mail]>
 Uploaders: Mike Hommey <[e-mail]>
 Build-Depends: debhelper (>= 9.20160403),
+ dh-exec,
  dpkg-dev (>= 1.17.14),
  libnspr4-dev (>= 2:4.24),
  zlib1g-dev,
diff --git a/debian/libnss3.links b/debian/libnss3.links
 new file mode 100755
index 0000000..717ff94
--- /dev/null
+++ b/debian/libnss3.links
@@ -0,0 +1,3 @@
+#!/usr/bin/dh-exec
+usr/lib/${DEB_HOST_MULTIARCH}/nss/libfreebl3.so usr/lib/${DEB_HOST_MULTIARCH}/libfreebl3.so
+usr/lib/${DEB_HOST_MULTIARCH}/nss/libfreeblpriv3.so usr/lib/${DEB_HOST_MULTIARCH}/libfreeblpriv3.so
diff --git a/debian/patches/disable_fips_enabled_read.patch b/debian/patches/disable_fips_enabled_read.patch
 new file mode 100644
index 0000000..7a87954
--- /dev/null
+++ b/debian/patches/disable_fips_enabled_read.patch
@@ -0,0 +1,49 @@
+commit 16996a9156c9ff2924bdb19ff43d40617a41c912
+Author: Vineetha Kamath <[e-mail]>
+Date:   Tue Jul 23 15:32:32 2019 -0400
+
+From: Vineetha Kamath<[e-mail]>
+Decription: Disable libgcrypt reading /proc/sys/crypto/fips_enabled
+file and going into FIPS mode. libnss is not a FIPS
+certified library.
+Bug-Ubuntu: http://bugs.launchpad.net/bugs/1837734
+Forwarded: not-needed
+
+diff --git a/nss/lib/freebl/nsslowhash.c b/nss/lib/freebl/nsslowhash.c
+index 22f9781..8433377 100644
+--- a/nss/lib/freebl/nsslowhash.c
++++ b/nss/lib/freebl/nsslowhash.c
+@@ -27,11 +27,13 @@ static int
+ nsslow_GetFIPSEnabled(void)
+ {
+ #ifdef LINUX
+-    FILE *f;
++    FILE *f = NULL;
+     char d;
+     size_t size;
+ 
++#if 0
+     f = fopen("/proc/sys/crypto/fips_enabled", "r");
++#endif
+     if (!f)
+         return 0;
+ 
+diff --git a/nss/lib/sysinit/nsssysinit.c b/nss/lib/sysinit/nsssysinit.c
+index bd0fac2..81f9b17 100644
+--- a/nss/lib/sysinit/nsssysinit.c
++++ b/nss/lib/sysinit/nsssysinit.c
+@@ -168,11 +168,13 @@ getFIPSEnv(void)
+ static PRBool
+ getFIPSMode(void)
+ {
+-    FILE *f;
++    FILE *f = NULL;
+     char d;
+     size_t size;
+ 
++#if 0
+     f = fopen("/proc/sys/crypto/fips_enabled", "r");
++#endif
+     if (!f) {
+         /* if we don't have a proc flag, fall back to the
+      * environment variable */
diff --git a/debian/patches/series b/debian/patches/series
index 9e1133d..e076305 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -3,3 +3,5 @@
 85_security_load.patch
 38_hppa.patch
 bz1608327-freebl-arm
+disable_fips_enabled_read.patch
+set-tls1.2-as-minimum.patch
diff --git a/debian/patches/set-tls1.2-as-minimum.patch b/debian/patches/set-tls1.2-as-minimum.patch
 new file mode 100644
index 0000000..a05d4e9
--- /dev/null
+++ b/debian/patches/set-tls1.2-as-minimum.patch
@@ -0,0 +1,17 @@
+Description: Set TLSv1.2 as minimum TLS version. LP: #1856428
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1856428
+
+
+Index: nss-3.48-1ubuntu1/nss/lib/ssl/sslsock.c
+===================================================================
+--- nss-3.48-1ubuntu1.orig/nss/lib/ssl/sslsock.c
++++ nss-3.48-1ubuntu1/nss/lib/ssl/sslsock.c
+@@ -96,7 +96,7 @@ static sslOptions ssl_defaults = {
+  * default range of enabled SSL/TLS protocols
+  */
+ static SSLVersionRange versions_defaults_stream = {
+-    SSL_LIBRARY_VERSION_TLS_1_0,
++    SSL_LIBRARY_VERSION_TLS_1_2,
+     SSL_LIBRARY_VERSION_TLS_1_3
+ };
+ 
diff --git a/debian/rules b/debian/rules
index ec951d3..b4c7302 100755
--- a/debian/rules
+++ b/debian/rules
@@ -175,7 +175,7 @@ override_dh_strip:
 
 ifeq ($(DEB_HOST_ARCH),$(DEB_BUILD_ARCH))
 	# Check FIPS mode correctly works
-	mkdir debian/tmp
+	mkdir -p debian/tmp
 	LD_LIBRARY_PATH=debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH):debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH)/nss debian/libnss3-tools/usr/bin/modutil -create -dbdir debian/tmp < /dev/null
 	LD_LIBRARY_PATH=debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH):debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH)/nss debian/libnss3-tools/usr/bin/modutil -fips true -dbdir debian/tmp < /dev/null
 endif