desktop-packages team mailing list archive

[Haw Loeung <1465014@xxxxxxxxxxxxxxxxxx>]

3.19.2 was just released[1] with:

"""
Notable Changes in NSS 3.19.2
Bug 1172128 - In NSS 3.19.1, the minimum key sizes that the freebl cryptographic implementation (part of the softoken cryptographic module used by default by NSS) was willing to generate or use was increased - for RSA keys, to 512 bits, and for DH keys, 1023 bits. This was done as part of a security fix for Bug 1138554 / CVE-2015-4000. Applications that requested or attempted to use keys smaller then the minimum size would fail. However, this change in behaviour unintentionally broke existing NSS applications that need to generate or use such keys, via APIs such as SECKEY_CreateRSAPrivateKey or SECKEY_CreateDHPrivateKey.

In NSS 3.19.2, this change in freebl behaviour has been reverted. The
fix for Bug 1138554 has been moved to libssl, and will now only affect
the minimum keystrengths used in SSL/TLS.

Note: Future versions of NSS may increase the minimum keysizes required by the freebl module. Consumers of NSS are strongly encouraged to migrate to stronger cryptographic strengths as soon as possible.
"""


[1]https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.2_release_notes

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2015-4000

-- 
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to firefox in Ubuntu.
https://bugs.launchpad.net/bugs/1465014

Title:
  after update still vulnerable against LOGJAM

Status in firefox package in Ubuntu:
  Confirmed
Status in nss package in Ubuntu:
  Confirmed

Bug description:
  Hint: http://www.ubuntu.com/usn/usn-2639-1/

  " As a security improvement, this update also modifies OpenSSL
  behaviour to reject DH key sizes below 768 bits, preventing a possible
  downgrade attack. "

  I installed the update but the test site says, i'm still vulnerable (see attachted screen shot).
  Site: https://weakdh.org/

  - Xubuntu 15.04  --  up-to-date

  - openSSL 1.0.1f-1ubuntu11.4  --  up-to-date

  - Firefox 38.0+build3-0ubuntu0.15.04.1  --   up-to-date (even there are the versions 38.0.5 and 38.0.6 on the mozilla server available)
  - Chromium 43.0.2357.81-0ubuntu0.15.04.1.1170  --  up-to-date

  --------------------------------------------------------------------------------

  ProblemType: Bug
  DistroRelease: Ubuntu 15.04
  Package: openssl 1.0.1f-1ubuntu11.4
  ProcVersionSignature: Ubuntu 3.19.0-20.20-generic 3.19.8
  Uname: Linux 3.19.0-20-generic x86_64
  ApportVersion: 2.17.2-0ubuntu1.1
  Architecture: amd64
  Date: Sun Jun 14 15:34:46 2015
  InstallationDate: Installed on 2015-05-28 (16 days ago)
  InstallationMedia: Xubuntu 15.04 "Vivid Vervet" - Release amd64 (20150422.1)
  SourcePackage: openssl
  UpgradeStatus: No upgrade log present (probably fresh install)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/1465014/+subscriptions