|
|
 |
|
|
Changelog for nss-3.90.0-2.el7_9.x86_64.rpm :
* Mon Aug 07 2023 Bob Relyea - 3.90.0-2- fix EMS bug- disbale ECH- fix gtests in spec file- restore missing test case
* Wed Jun 21 2023 Bob Relyea - 3.90.0-1- Rebase to NSS 3.90
* Wed Mar 08 2023 Bob Relyea - 3.79.0-5- fix CVE-2023-0767
* Thu Jul 21 2022 Bob Relyea - 3.79.0-4- fix regression for pkcs12.
* Wed Jul 06 2022 Bob Relyea - 3.79.0-3- fix crash in curl. better fix for the regression below
* Sat Jun 11 2022 Bob Relyea - 3.79.0-2- fix regressions found in test suite
* Wed Jun 08 2022 Bob Relyea - 3.79.0-1- Rebase to NSS 3.79- Set FIPS Module ID
* Thu Nov 18 2021 Bob Relyea - 3.67.0-4- fix CVE-2021-43527
* Tue Sep 14 2021 Bob Relyea - 3.67.0-3- revert sql default language in man pages- fix SEC_PKCS12EnableCipher so python-nss tests will still work.
* Wed Jul 07 2021 Bob Relyea - 3.67.0-2- fix sdb timeout issue- fix incorrect ssl alerts in Signature scheme processing
* Tue Jun 22 2021 Bob Relyea - 3.67.0-1- Rebase to NSS 3.67
* Tue Jun 15 2021 Bob Relyea - 3.66.0-2- restore pkcs12 defaults
* Thu Jun 03 2021 Bob Relyea - 3.66.0-1- Rebase to NSS 3.66
* Wed Mar 03 2021 Bob Relyea - 3.53.1-7- Fix HSM load failure because of CKO_Profile- Allow builds with strict-proto
* Mon Feb 22 2021 Bob Relyea - 3.53.1-6- Update to CVE 2020-256423 TLS flood DOS attack patch.
* Thu Feb 18 2021 Bob Relyea - 3.53.1-5- Fix CVE 2020-256423 TLS flood DOS Attack.
* Mon Feb 01 2021 Bob Relyea - 3.53.1-4- Fix deadlock issue- Fix 3 FTBS issues, 2 expired certs, one semantic change in nss-softokn.
* Sat Aug 01 2020 Daiki Ueno - 3.53.1-3- Disable dh timing test because it\'s unreliable on s390 (from Bob Relyea)- Explicitly enable upgradedb/sharedb test cycles
* Thu Jul 30 2020 Daiki Ueno - 3.53.1-2- Disable TLS 1.3 by default
* Wed Jul 22 2020 Daiki Ueno - 3.53.1-1- Rebase to NSS 3.53.1
* Fri Dec 06 2019 Bob Relyea - 3.44.0-8- Increase timeout on ssl_gtest so that slow platforms can complete when running on a busy system.
* Thu Dec 05 2019 Bob Relyea - 3.44.0-7- back out out-of-bounds patch (patch for nss-softokn).- Fix segfault on empty or malformed ecdh keys (#1777712)
* Wed Dec 04 2019 Bob Relyea - 3.44.0-6- Fix out-of-bounds write in NSC_EncryptUpdate (#1775911,#1775910)
* Wed Aug 14 2019 Bob Relyea - 3.44.0-5- Fix pkix name constraints processing to only process the common name if the certusage you are checking is IPSEC or SSL Server.
* Wed Jun 05 2019 Bob Relyea - 3.44.0-4- Fix certutil man page- Fix extracting a public key from a private key for dh, ec, and dsa
* Thu May 30 2019 Daiki Ueno - 3.44.0-3- Disable TLS 1.3 under FIPS mode- Disable RSASSA-PKCS1-v1_5 in TLS 1.3- Fix post-handshake auth transcript calculation if SSL_ENABLE_SESSION_TICKETS is set
* Thu May 16 2019 Daiki Ueno - 3.44.0-2- Skip sysinit gtests properly- Fix shell syntax error in tests/ssl/ssl.sh- Regenerate manual pages
* Wed May 15 2019 Daiki Ueno - 3.44.0-1- Rebase to NSS 3.44- Restore fix-min-library-version-in-SSLVersionRange.patch to keep SSL3 supported in the code level while it is disabled by policy- Skip TLS 1.3 tests under FIPS mode
* Fri May 10 2019 Daiki Ueno - 3.43.0-9- Ignore system policy when running %check
* Fri May 03 2019 Daiki Ueno - 3.43.0-8- Fix policy string
* Fri Apr 26 2019 Daiki Ueno - 3.43.0-7- Don\'t override date in man-pages- Revert the change to use XDG basedirs (mozilla#818686)- Enable SSL2 compatible ClientHello by default- Disable SSL3 and RC4 by default
* Mon Apr 08 2019 Daiki Ueno - 3.43.0-6- Make \"-V ssl3:\" option work with tools
* Fri Apr 05 2019 Daiki Ueno - 3.43.0-5- Fix regression in MD5 disablement
* Mon Apr 01 2019 Bob Relyea - 3.43.0-4- add certutil documentation
* Thu Mar 28 2019 Daiki Ueno - 3.43.0-3- Restore complete removal of SSLv2- Disable SSLv3- Move signtool to unsupported directory
* Mon Mar 25 2019 Bob Relyea - 3.43.0-2- Expand IPSEC usage to include ssl and email certs. Remove special processing of the usage based on the critical flag
* Thu Mar 21 2019 Daiki Ueno - 3.43.0-1- Rebase to NSS 3.43
* Mon Feb 25 2019 Bob Relyea - 3.36.0-8.1- move key on unwrap failure and retry.
* Mon Nov 12 2018 Bob Relyea - 3.36.0-8- Update the cert verify code to allow a new ipsec usage and follow RFC 4945
* Wed Aug 29 2018 Daiki Ueno - 3.36.0-7- Backport upstream fix for CVE-2018-12384- Remove nss-lockcert-api-change.patch, which turned out to be a mistake (the symbol was not exported from libnss)
* Thu Apr 19 2018 Daiki Ueno - 3.36.0-6- Exercise SSL tests which only run under non-FIPS setting
* Wed Apr 18 2018 Daiki Ueno - 3.36.0-5- Restore CERT_LockCertTrust and CERT_UnlockCertTrust back in cert.h
* Fri Apr 13 2018 Daiki Ueno - 3.36.0-4- Work around modutil -changepw error if the old and new passwords are both empty in FIPS mode
* Tue Mar 27 2018 Daiki Ueno - 3.36.0-3- Decrease the iteration count of PKCS#12 for compatibility with Windows- Fix deadlock when a token is re-inserted while a client process is running
* Mon Mar 12 2018 Daiki Ueno - 3.36.0-2- Set NSS_FORCE_FIPS=1 in %build- Revert the changes to tests assuming the default DB type
* Fri Mar 09 2018 Daiki Ueno - 3.36.0-1- Rebase to NSS 3.36
* Mon Jan 15 2018 Daiki Ueno - 3.34.0-4- Re-enable nss-is-token-present-race.patch
* Fri Jan 05 2018 Daiki Ueno - 3.34.0-3- Temporarily disable nss-is-token-present-race.patch
* Thu Jan 04 2018 Daiki Ueno - 3.34.0-2- Backport necessary changes from 3.35
* Fri Nov 24 2017 Daiki Ueno - 3.34.0-1- Rebase to NSS 3.34
* Mon Oct 30 2017 Daiki Ueno - 3.34.0-0.1.beta1- Rebase to NSS 3.34.BETA1
* Wed Oct 25 2017 Daiki Ueno - 3.33.0-3- Disable TLS 1.3
* Wed Oct 18 2017 Daiki Ueno - 3.33.0-2- Enable TLS 1.3
* Mon Oct 16 2017 Daiki Ueno - 3.33.0-1- Rebase to NSS 3.33- Disable TLS 1.3, temporarily disable failing gtests (Skip13Variants)- Temporarily disable race.patch and nss-3.16-token-init-race.patch, which causes a deadlock in newly added test cases- Remove upstreamed patches: moz-1320932.patch, nss-tstclnt-optspec.patch, nss-1334976-1336487-1345083-ca-2.14.patch, nss-alert-handler.patch, nss-tools-sha256-default.patch, nss-is-token-present-race.patch, nss-pk12util.patch, nss-ssl3gthr.patch, and nss-transcript.patch
* Mon Oct 16 2017 Daiki Ueno - 3.28.4-14- Add backward compatibility to pk12util regarding faulty PBES2 AES encryption
* Mon Oct 16 2017 Daiki Ueno - 3.28.4-13- Update iquote.patch to prefer nss.h from the source
* Mon Oct 16 2017 Daiki Ueno - 3.28.4-12- Add backward compatibility to pk12util regarding password encoding
* Thu Aug 10 2017 Daiki Ueno - 3.28.4-11- Backport patch to simplify transcript calculation for CertificateVerify- Enable TLS 1.3 and RSA-PSS- Disable some upstream tests failing due to downstream ciphersuites changes
* Thu Jul 13 2017 Daiki Ueno - 3.28.4-10- Work around yum crash due to new NSPR symbol being used in nss-sysinit, patch by Kai Engert
* Fri Jun 02 2017 Daiki Ueno - 3.28.4-9- Fix typo in nss-sni-c-v-fix.patch
* Fri May 05 2017 Kai Engert - 3.28.4-8- Include CKBI 2.14 and updated CA constraints from NSS 3.28.5
* Fri May 05 2017 Daiki Ueno - 3.28.4-7- Update nss-pk12util.patch to include fix from mozbz#1353724.
* Wed May 03 2017 Daiki Ueno - 3.28.4-6- Update nss-alert-handler.patch with the upstream fix from mozbz#1360207.
* Fri Apr 28 2017 Daiki Ueno - 3.28.4-5- Fix zero-length record treatment for stream ciphers and SSLv2
* Thu Apr 27 2017 Daiki Ueno - 3.28.4-4- Correctly set policy file location when building
* Wed Apr 26 2017 Daiki Ueno - 3.28.4-3- Reorder ChaCha20-Poly1305 cipher suites, as suggested in: https://bugzilla.redhat.com/show_bug.cgi?id=1373158#c9
* Thu Apr 20 2017 Daiki Ueno - 3.28.4-2- Rebase to NSS 3.28.4- Update nss-pk12util.patch with backport of mozbz#1353325
* Thu Mar 16 2017 Daiki Ueno - 3.28.3-5- Switch default hash algorithm used by tools from SHA-1 to SHA-256- Avoid race condition in nssSlot_IsTokenPresent()- Enable SHA-2 and AES in pk12util- Disable RSA-PSS for now
* Fri Mar 10 2017 Daiki Ueno - 3.28.3-4- Utilize CKA_NSS_MOZILLA_CA_POLICY attribute, patch by Kai Engert- Backport changes adding SSL alert callbacks from upstream- Add nss-check-policy-file.patch from Fedora- Install policy config in /etc/pki/nss-legacy/nss-rhel7.config
* Mon Mar 06 2017 Daiki Ueno - 3.28.3-3- Make sure 32bit nss-pem always be installed with 32bit nss in multlib environment, patch by Kamil Dudka- Enable new algorithms supported by the new nss-softokn
* Mon Mar 06 2017 Daiki Ueno - 3.28.3-2- Rebase to NSS 3.28.3- Bump required version of nss-softokn
* Wed Feb 15 2017 Daiki Ueno - 3.28.2-3- Remove %nss_cycles setting, which was also mistakenly added- Re-enable BUILD_OPT, mistakenly disabled in the previous build- Prevent ABI incompatibilty of SECKEYECPublicKey- Disable TLS_ECDHE_{RSA,ECDSA}_WITH_AES_128_CBC_SHA256 by default- Enable 4 AES_256_GCM_SHA384 ciphersuites, enabled by the downstream patch in the previous release- Fix crash with tstclnt -W- Always enable gtests for supported features- Add patch to fix bash syntax error in tests/ssl.sh- Build with support for SSLKEYLOGFILE- Disable the use of RSA-PSS with SSL/TLS
* Tue Feb 14 2017 Daiki Ueno - 3.28.2-2- Decouple nss-pem from the nss package- Resolves: #1316546
* Mon Feb 13 2017 Daiki Ueno - 3.28.2-1.1- Remove mistakenly added R: nss-pem
* Fri Feb 10 2017 Daiki Ueno - 3.28.2-1.0- Rebase to NSS 3.28.2- Remove NSS_ENABLE_ECC and NSS_ECC_MORE_THAN_SUITE_B setting, which is no-op now- Enable gtests when requested- Remove nss-646045.patch and fix-nss-test-filtering.patch, which are not necessary- Remove sslauth-no-v2.patch and nss-sslstress-txt-ssl3-lower-value-in-range.patch, as SSLv2 is already disabled in upstream- Remove ssl-server-min-key-sizes.patch, as we decided to support DH key size greater than 1023 bits- Remove local patches for SHA384 cipher suites (now supported in upstream): dhe-sha384-dss-support.patch, client_auth_for_sha384_prf_support.patch, nss-fix-client-auth-init-hashes.patch, nss-map-oid-to-hashalg.patch, nss-enable-384-cipher-tests.patch, nss-fix-signature-and-hash.patch, fix-allowed-sig-alg.patch, tests-extra.patch- Remove upstreamed patches: rh1238290.patch, fix-reuse-of-session-cache-entry.patch, flexible-certverify.patch, call-restartmodules-in-nssinit.patch
* Wed Oct 26 2016 Daiki Ueno - 3.21.3-1- Rebase to NSS 3.21.3- Resolves: #1383887
* Thu Jun 30 2016 Kai Engert - 3.21.0-17- remove additional false duplicates from sha384 downstream patches
* Tue Jun 28 2016 Kai Engert - 3.21.0-16- enable ssl_gtests (without extended master secret tests), Bug 1298692- call SECMOD_RestartModules in nss_Init, Bug 1317691
* Fri Jun 17 2016 Kai Engert - 3.21.0-15- escape all percent characters in all changelog comments
* Fri Jun 17 2016 Kai Engert - 3.21.0-14- Support TLS 1.2 certificate_verify hashes other than PRF, backported fix from NSS 3.25 (upstream bug 1179338).
* Mon May 23 2016 Elio Maldonado - 3.21.0-13- Fix reuse of session cache entry- Resolves: Bug 1241172 - Certificate verification fails with multiple https urls
* Wed Apr 20 2016 Elio Maldonado - 3.21.0-12- Fix a flaw in %check for nss not building on arm- Resolves: Bug 1200856
* Wed Apr 20 2016 Elio Maldonado - 3.21.0-11- Cleanup: Remove unnecessary %posttrans script from nss.spec- Resolves: Bug 1174201
* Wed Apr 20 2016 Elio Maldonado - 3.21.0-10- Merge fixes from the rhel-7.2 branch- Fix a bogus %changelog entry- Resolves: Bug 1297941
* Fri Apr 15 2016 Kai Engert - 3.21.0-9- Rebuild to require the latest nss-util build and nss-softokn build.
* Mon Apr 11 2016 Kai Engert - 3.21.0-8- Update the minimum nss-softokn build required at runtime.
* Mon Apr 04 2016 Elio Maldonado - 3.21.0-7- Delete duplicates from one table
* Tue Mar 29 2016 Kai Engert - 3.21.0-6- Fix missing support for sha384/dsa in certificate_request
* Wed Mar 23 2016 Kai Engert - 3.21.0-5- Merge fixes from the rhel-7.2 branch- Fix the SigAlgs sent in certificate_request- Ensure all ssl.sh tests are executed- Update sslauth test patch to run additional tests
* Fri Feb 26 2016 Elio Maldonado - 3.21.0-2- Fix sha384 support and testing patches
* Wed Feb 17 2016 Elio Maldonado - 3.21.0-1- Rebase to NSS-3.21
* Tue Dec 15 2015 Elio Maldonado - 3.19.1-19- Prevent TLS 1.2 Transcript Collision attacks against MD5 in key exchange protocol- Fix a mockbuild reported bad %if condition when using the __isa_bits macro instead of list of 64-bit architectures- Change the test to %if 0%{__isa_bits} == 64 as required for building the srpm which is noarch- Resolves: Bug 1289884
* Wed Oct 21 2015 Kai Engert - 3.19.1-18- Rebuild against updated NSPR
* Thu Sep 03 2015 Elio Maldonado - 3.19.1-17- Change the required_softokn_build_version back to -13- Ensure we use nss-softokn-3.16.2.3-13.el7_1
* Thu Sep 03 2015 Elio Maldonado - 3.19.1-16- Fix check for public key size of DSA certificates- Use size of prime P not the size of dsa.publicValue
* Mon Aug 31 2015 Elio Maldonado - 3.19.1-15- Reorder the cipher suites and enable two more by default
* Sun Aug 30 2015 Elio Maldonado - 3.19.1-14- Update the required_softokn_build_version to -14- Add references to bugs filed upstream for new patches- Merge ocsp stapling and sslauth sni tests patches into one
* Sat Aug 29 2015 Elio Maldonado - 3.19.1-13- Reorder the cipher suites and enable two more by default- Fix some of the ssauth sni and ocsp stapling tests
* Thu Aug 27 2015 Elio Maldonado - 3.19.1-12- Support TLS > 1.0 by support while still allowing to connect to SSL3 only servers- Enable ECDSA cipher suites by default, a subset of the ones requested
* Wed Aug 26 2015 Elio Maldonado - 3.19.1-11- Support TLS > 1.0 by support while still allowing to connect to SSL3 only servers
* Mon Aug 17 2015 Elio Maldonado - 3.19.1-10- Fix to correctly report integrity mechanism for TLS_RSA_WITH_AES_256_GCM_SHA384
* Mon Aug 10 2015 Elio Maldonado - 3.19.1-9- Fix checks to skip ssl2/export cipher suites tests to not skip needed tests- Fix libssl ssl2/export disabling patch to handle NULL cipher cases- Enable additional cipher suites by default
* Thu Jul 16 2015 Elio Maldonado - 3.19.1-8- Add links to filed upstream bugs to better track patches in spec file
* Tue Jul 07 2015 Elio Maldonado - 3.19.1-7- Package listsuites as part of the unsupported tools
* Thu Jul 02 2015 Elio Maldonado - 3.19.1-6- Bump the release tag
* Mon Jun 29 2015 Kai Engert - 3.19.1-5- Incremental patches to fix SSL/TLS test suite execution, fix the earlier SHA384 patch, and inform clients to use SHA384 with certificate_verify if required by NSS.
* Thu Jun 18 2015 Elio Maldonado - 3.19.1-4- Add support for sha384 tls cipher suites- Add support for server-side hde key exchange- Add support for DSS+SHA256 ciphersuites
* Wed Jun 10 2015 Elio Maldonado - 3.19.1-3- Reenable a patch that had been mistakenly disabled
* Wed Jun 10 2015 Elio Maldonado - 3.19.1-2- Build against nss-softokn-3.16.2.3-9
* Fri Jun 05 2015 Elio Maldonado - 3.19.1-1- Rebase to nss-3.19.1- Resolves: Bug 1228913 - Rebase to nss-3.19.1 for CVE-2015-4000 [RHEL-7.1]
* Tue Apr 28 2015 Kai Engert - 3.18.0-6- Backport mozbz#1155922 to support SHA512 signatures with TLS 1.2
* Thu Apr 23 2015 Kai Engert - 3.18.0-5- Update to CKBI 2.4 from NSS 3.18.1 (the only change in NSS 3.18.1)
* Fri Apr 17 2015 Elio Maldonado - 3.18.0-4- Update and reeneable nss-646045.patch on account of the rebase- Resolves: Bug 1200898 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]
* Tue Apr 14 2015 Elio Maldonado - 3.18.0-3- Fix shell syntax error on nss/tests/all.sh- Resolves: Bug 1200898 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]
* Fri Apr 10 2015 Elio Maldonado - 3.18.0-2- Replace expired PayPal test certificate that breaks the build- Resolves: Bug 1200898 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]
* Mon Mar 30 2015 Elio Maldonado - 3.18.0-1- Resolves: Bug 1200898 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]
* Mon Jan 19 2015 Elio Maldonado - 3.16.2.3-5- Reverse the sense of a test in patch to fix pk12util segfault- Resolves: Bug 1174527 - Segfault in pk12util when using -l option with certain .p12 files
* Thu Jan 08 2015 Elio Maldonado - 3.16.2.3-4- Fix race condition- Resolves: Bug 1094468 - 389-ds-base server reported crash in stan_GetCERTCertificate- under the replication replay failure condition
* Wed Jan 07 2015 Elio Maldonado - 3.16.2.3-3- Resolves: Bug 1174527 - Segfault in pk12util when using -l option with certain .p12 files
* Tue Nov 25 2014 Elio Maldonado - 3.16.2.3-2- Restore patch for certutil man page- supply missing options descriptions- Resolves: Bug 1158161 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
* Thu Nov 13 2014 Elio Maldonado - 3.16.2-10- Resolves: Bug 1158161 - Upgrade to NSS 3.16.2.3 for Firefox 31.3- Support TLS_FALLBACK_SCSV in tstclnt and ssltap
* Mon Sep 29 2014 Elio Maldonado - 3.16.2-9- Resolves: Bug 1145434 - CVE-2014-1568- Using a release number higher than on rhel-7.0 branch
* Mon Aug 11 2014 Elio Maldonado - 3.16.2-4- Fix crash in stan_GetCERTCertificate- Resolves: Bug 1094468
* Tue Aug 05 2014 Elio Maldonado 3.16.2-3- Generic 32/64 bit platform detection (fix ppc64le build)- Resolves: Bug 1125619 - nss fails to build on arch: ppc64le (missing dependencies)- Fix contributed by Peter Robinson
* Fri Aug 01 2014 Elio Maldonado - 3.16.2-2- Fix libssl and test patches that disable ssl2 support- Resolves: Bug 1123435- Replace expired PayPal test certificate with current one
* Tue Jul 08 2014 Elio Maldonado - 3.16.2-1- Rebase to nss-3.16.2- Resolves: Bug 1103252 - Rebase RHEL 7.1 to at least NSS 3.16.1 (FF 31)- Fix test failure detection in the %check section- Move removal of unwanted source directories to the end of the %prep section- Update various patches on account of the rebase- Remove unused patches rendered obsolete by the rebase
* Mon Mar 03 2014 Elio Maldonado - 3.15.4-6- Disallow disabling the internal module- Resolves: Bug 1056036 - nss segfaults with opencryptoki module
* Thu Feb 20 2014 Elio Maldonado - 3.15.4-5- Pick up a fix from rhel-6 and fix an rpm conflict- Don\'t hold issuer cert handles in crl cache- Resolves: Bug 1034409 - deadlock in trust domain and object lock- Move nss shared db files to the main package- Resolves: Bug 1050163 - Same files in two packages create rpm conflict
* Mon Jan 27 2014 Elio Maldonado - 3.15.4-4- Update pem sources to latest from nss-pem upstream- Pick up pem module fixes verified on RHEL and applied upstream- Remove no loger needed pem patches on acccount on this update- Add comments documenting the iquote.patch - Resolves: Bug 1054457 - CVE-2013-1740
* Sun Jan 26 2014 Elio Maldonado - 3.15.4-3- Remove spurious man5 wildcard entry as all manpages are listed by name- Resolves: Bug 1050163 - Same files in two packages create rpm conflict
* Fri Jan 24 2014 Daniel Mach - 3.15.4-2- Mass rebuild 2014-01-24
* Sun Jan 19 2014 Elio Maldonado - 3.15.3-9- Rebase to nss-3.15.4- Resolves: Bug 1054457 - CVE-2013-1740 nss: false start PR_Recv information disclosure security issue- Remove no longer needed patches for manpages that were applied upstream- Remove no longer needed patch to disable ocsp stapling tests- Update iquote.patch on account of upstream changes- Update and rename patch to pem/rsawrapr.c on account of upstream changes- Use the pristine upstream sources for nss without repackaging- Avoid unneeded manual step which may introduce errors
* Sun Jan 19 2014 Elio Maldonado - 3.15.3-8- Fix the spec file to apply the nss ecc list patch for bug 752980- Resolves: Bug 752980 - Support ECDSA algorithm in the nss package via puggable ecc
* Fri Jan 17 2014 Elio Maldonado - 3.15.3-7- Move several nss-sysinit manpages tar archives to the %files- Resolves: Bug 1050163 - Same files in two packages create rpm conflict
* Fri Jan 17 2014 Elio Maldonado - 3.15.3-6- Fix a coverity scan compile time warning for the pem module- Resolves: Bug 1002271 - NSS pem module should not require unique base file names
* Wed Jan 15 2014 Elio Maldonado - 3.15.3-5- Resolves: Bug 1002271 - NSS pem module should not require unique base file names
* Thu Jan 09 2014 Elio Maldonado - 3.15.3-4- Improve pluggable ECC support for ECDSA- Resolves: Bug 752980 - [7.0 FEAT] Support ECDSA algorithm in the nss package
* Fri Dec 27 2013 Daniel Mach - 3.15.3-3- Mass rebuild 2013-12-27
* Thu Dec 12 2013 Elio Maldonado - 3.15.3-2- Revoke trust in one mis-issued anssi certificate- Resolves: Bug 1040284 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117) [rhel-7.0]
* Mon Nov 25 2013 Elio Maldonado - 3.15.3-1- Update to NSS_3_15_3_RTM- Resolves: Bug 1031463 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741
* Wed Nov 13 2013 Elio Maldonado - 3.15.2-10- Fix path to script and remove -- from some options in nss-sysinit man page- Resolves: rhbz#982723 - man page of nss-sysinit worong path and other flaws
* Tue Nov 12 2013 Elio Maldonado - 3.15.2-9- Fix certutil man page options names to be consistent with help- Resolves: rhbz#948495 - man page scan results for nss- Remove incorrect count argument in status description in nss-sysinit man page- Resolves: rhbz#982723 - man page of nss-sysinit incorrect option descriptions
* Wed Nov 06 2013 Elio Maldonado - 3.15.2-8- Fix patch for disabling ssl2 in ssl to correctly set error code- Fix syntax error reported in the build.log even tough it succeeds- Add patch top ignore setpolicy result - Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites- Resolves: rhbz#1026677 - Attempt to run ipa-client-install fails
* Sun Nov 03 2013 Elio Maldonado - 3.15.2-7- Fix bash syntax error in patch for disabling ssl2 tests- Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites
* Sat Nov 02 2013 Elio Maldonado - 3.15.2-6- Fix errors in ssl disabling patches for both library and tests- Add s390x to the multilib_arches definition used for alt_ckbi- Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites
* Thu Oct 31 2013 Elio Maldonado - 3.15.2-5- Fix errors in nss-sysinit manpage options descriptions- Resolves: rhbz#982723
* Tue Oct 29 2013 Elio Maldonado - 3.15.2-4- Enable fips when system is in fips mode- Resolves: rhbz#852023 - FIPS mode detection does not work
* Tue Oct 29 2013 Elio Maldonado - 3.15.2-3- Remove unused and obsoleted patches- Related: rhbz#1012656
* Mon Oct 28 2013 Elio Maldonado - 3.15.2-2- Add description of the certutil\'s --email option to it\'s manpage- Resolves: rhbz#Bug 948495 - Man page scan results for nss
* Mon Oct 21 2013 Elio Maldonado - 3.15.2-1- Rebase to nss-3.15.2- Resolves: rhbz#1012656 - pick up NSS 3.15.2 to fix CVE-2013-1739 and disable MD5 in OCSP/CRL
* Fri Oct 11 2013 Elio Maldonado - 3.15.1-4- Install symlink to nss-sysinit.sh without the .sh suffix- Resolves: rhbz#982723 - nss-sysinit man page has wrong path for the script
* Tue Oct 08 2013 Elio Maldonado - 3.15.1-3- Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites
* Tue Aug 06 2013 Elio Maldonado - 3.15.1-2- Add upstream bug URL for a patch subitted upstream and remove obsolete script
* Wed Jul 24 2013 Elio Maldonado - 3.15.1-2- Update to NSS_3_15_1_RTM- Apply various fixes to the man pages and add new ones- Enable the iquote.patch to access newly introduced types- Add man page for pkcs11.txt configuration file and cert and key databases- Add missing option descriptions for {cert|cms|crl}util- Resolves: rhbz#948495 - Man page scan results for nss- Resolves: rhbz#982723 - Fix path to script in man page for nss-sysinit
* Tue Jul 02 2013 Elio Maldonado - 3.15-6- Use the unstripped source tar ball
* Wed Jun 19 2013 Elio Maldonado - 3.15-5- Install man pages for nss-tools and the nss-config and setup-nsssysinit scripts- Resolves: rhbz#606020 - nss security tools lack man pages
* Tue Jun 18 2013 emaldona - 3.15-4- Build nss without softoken or util sources in the tree- Resolves: rhbz#689918
* Mon Jun 17 2013 emaldona - 3.15-3- Update ssl-cbc-random-iv-by-default.patch
* Sun Jun 16 2013 Elio Maldonado - 3.15-2- Fix generation of NSS_VMAJOR, NSS_VMINOR, and NSS_VPATCH for nss-config
* Sat Jun 15 2013 Elio Maldonado - 3.15-1- Update to NSS_3_15_RTM
* Tue May 14 2013 Elio Maldonado - 3.14.3-13.0- Reactivate nss-ssl-cbc-random-iv-off-by-default.patch
* Fri Apr 19 2013 Kai Engert - 3.14.3-12.0- Add upstream patch to fix rhbz#872761
* Sun Mar 24 2013 Kai Engert - 3.14.3-11- Update expired test certificates (fixed in upstream bug 852781)
* Fri Mar 08 2013 Kai Engert - 3.14.3-10- Fix incorrect post/postun scripts. Fix broken links in posttrans.
* Wed Mar 06 2013 Kai Engert - 3.14.3-9- Configure libnssckbi.so to use the alternatives system in order to prepare for a drop in replacement.
* Fri Feb 15 2013 Elio Maldonado - 3.14.3-1- Update to NSS_3_14_3_RTM- sync up pem rsawrapr.c with softoken upstream changes for nss-3.14.3- Resolves: rhbz#908257 - CVE-2013-1620 nss: TLS CBC padding timing attack- Resolves: rhbz#896651 - PEM module trashes private keys if login fails- Resolves: rhbz#909775 - specfile support for AArch64- Resolves: rhbz#910584 - certutil -a does not produce ASCII output
* Mon Feb 04 2013 Elio Maldonado - 3.14.2-2- Allow building nss against older system sqlite
* Fri Feb 01 2013 Elio Maldonado - 3.14.2-1- Update to NSS_3_14_2_RTM
* Wed Jan 02 2013 Kai Engert - 3.14.1-3- Update to NSS_3_14_1_WITH_CKBI_1_93_RTM
* Sat Dec 22 2012 Elio Maldonado - 3.14.1-2- Require nspr >= 4.9.4- Fix changelog invalid dates
* Mon Dec 17 2012 Elio Maldonado - 3.14.1-1- Update to NSS_3_14_1_RTM
* Wed Dec 12 2012 Elio Maldonado - 3.14-12- Bug 879978 - Install the nssck.api header template where mod_revocator can access it- Install nssck.api in /usr/includes/nss3/templates
* Tue Nov 27 2012 Elio Maldonado - 3.14-11- Bug 879978 - Install the nssck.api header template in a place where mod_revocator can access it- Install nssck.api in /usr/includes/nss3
* Mon Nov 19 2012 Elio Maldonado - 3.14-10- Bug 870864 - Add support in NSS for Secure Boot
* Sat Nov 10 2012 Elio Maldonado - 3.14-9- Disable bypass code at build time and return failure on attempts to enable at runtime- Bug 806588 - Disable SSL PKCS #11 bypass at build time
* Sun Nov 04 2012 Elio Maldonado - 3.14-8- Fix pk11wrap locking which fixes \'fedpkg new-sources\' and \'fedpkg update\' hangs- Bug 872124 - nss-3.14 breaks fedpkg new-sources- Fix should be considered preliminary since the patch may change upon upstream approval
* Thu Nov 01 2012 Elio Maldonado - 3.14-7- Add a dummy source file for testing /preventing fedpkg breakage- Helps test the fedpkg new-sources and upload commands for breakage by nss updates- Related to Bug 872124 - nss 3.14 breaks fedpkg new-sources
* Thu Nov 01 2012 Elio Maldonado - 3.14-6- Fix a previous unwanted merge from f18- Update the SS_SSL_CBC_RANDOM_IV patch to match new sources while- Keeping the patch disabled while we are still in rawhide and- State in comment that patch is needed for both stable and beta branches- Update .gitignore to download only the new sources
* Wed Oct 31 2012 Elio Maldonado - 3.14-5- Fix the spec file so sechash.h gets installed- Resolves: rhbz#871882 - missing header: sechash.h in nss 3.14
* Sat Oct 27 2012 Elio Maldonado - 3.14-4- Update the license to MPLv2.0
* Wed Oct 24 2012 Elio Maldonado - 3.14-3- Use only -f when removing unwanted headers
* Tue Oct 23 2012 Elio Maldonado - 3.14-2- Add secmodt.h to the headers installed by nss-devel- nss-devel must install secmodt.h which moved from softoken to pk11wrap with nss-3.14
* Mon Oct 22 2012 Elio Maldonado - 3.14-1- Update to NSS_3_14_RTM
* Sun Oct 21 2012 Elio Maldonado - 3.14-0.1.rc.1- Update to NSS_3_14_RC1- update nss-589636.patch to apply to httpdserv- turn off ocsp tests for now- remove no longer needed patches- remove headers shipped by nss-util
* Fri Oct 05 2012 Kai Engert - 3.13.6-1- Update to NSS_3_13_6_RTM
* Mon Aug 27 2012 Elio Maldonado - 3.13.5-8- Rebase pem sources to fedora-hosted upstream to pick up two fixes from rhel-6.3- Resolves: rhbz#847460 - Fix invalid read and free on invalid cert load- Resolves: rhbz#847462 - PEM module may attempt to free uninitialized pointer - Remove unneeded fix gcc 4.7 c++ issue in secmodt.h that actually undoes the upstream fix
* Mon Aug 13 2012 Elio Maldonado - 3.13.5-7- Fix pluggable ecc support
* Fri Jul 20 2012 Fedora Release Engineering - 3.13.5-6- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
* Sun Jul 01 2012 Elio Maldonado - 3.13.5-5- Fix checkin comment to prevent unwanted expansions of percents
* Sun Jul 01 2012 Elio Maldonado - 3.13.5-4- Resolves: Bug 830410 - Missing Requires %{?_isa}- Use Requires: %{name}%{?_isa} = %{version}-%{release} on tools- Drop zlib requires which rpmlint reports as error E: explicit-lib-dependency zlib- Enable sha224 portion of powerup selftest when running test suites- Require nspr 4.9.1
* Wed Jun 20 2012 Elio Maldonado - 3.13.5-3- Resolves: rhbz#833529 - revert unwanted change to nss.pc.in
* Tue Jun 19 2012 Elio Maldonado - 3.13.5-2- Resolves: rhbz#833529 - Remove unwanted space from the Libs: line on nss.pc.in
* Mon Jun 18 2012 Elio Maldonado - 3.13.5-1- Update to NSS_3_13_5_RTM
* Fri Apr 13 2012 Elio Maldonado - 3.13.4-3- Resolves: Bug 812423 - nss_Init leaks memory, fix from RHEL 6.3
* Sun Apr 08 2012 Elio Maldonado - 3.13.4-2- Resolves: Bug 805723 - Library needs partial RELRO support added- Patch coreconf/Linux.mk as done on RHEL 6.2
* Fri Apr 06 2012 Elio Maldonado - 3.13.4-1- Update to NSS_3_13_4_RTM- Update the nss-pem source archive to the latest version- Remove no longer needed patches- Resolves: Bug 806043 - use pem files interchangeably in a single process- Resolves: Bug 806051 - PEM various flaws detected by Coverity- Resolves: Bug 806058 - PEM pem_CreateObject leaks memory given a non-existing file name
* Wed Mar 21 2012 Elio Maldonado - 3.13.3-4- Resolves: Bug 805723 - Library needs partial RELRO support added
* Fri Mar 09 2012 Elio Maldonado - 3.13.3-3- Cleanup of the spec file- Add references to the upstream bugs- Fix typo in Summary for sysinit
* Thu Mar 08 2012 Elio Maldonado - 3.13.3-2- Pick up fixes from RHEL- Resolves: rhbz#800674 - Unable to contact LDAP Server during winsync- Resolves: rhbz#800682 - Qpid AMQP daemon fails to load after nss update- Resolves: rhbz#800676 - NSS workaround for freebl bug that causes openswan to drop connections
* Thu Mar 01 2012 Elio Maldonado - 3.13.3-1- Update to NSS_3_13_3_RTM
* Mon Jan 30 2012 Tom Callaway - 3.13.1-13- fix issue with gcc 4.7 in secmodt.h and C++11 user-defined literals
* Thu Jan 26 2012 Elio Maldonado - 3.13.1-12- Resolves: Bug 784672 - nss should protect against being called before nss_Init
* Fri Jan 13 2012 Fedora Release Engineering - 3.13.1-11- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
* Fri Jan 06 2012 Elio Maldonado - 3.13.1-11- Deactivate a patch currently meant for stable branches only
* Fri Jan 06 2012 Elio Maldonado - 3.13.1-10- Resolves: Bug 770682 - nss update breaks pidgin-sipe connectivity- NSS_SSL_CBC_RANDOM_IV set to 0 by default and changed to 1 on user request
* Tue Dec 13 2011 elio maldonado - 3.13.1-9- Revert to using current nss_softokn_version- Patch to deal with lack of sha224 is no longer needed
* Tue Dec 13 2011 Elio Maldonado - 3.13.1-8- Resolves: Bug 754771 - [PEM] an unregistered callback causes a SIGSEGV
* Mon Dec 12 2011 Elio Maldonado - 3.13.1-7- Resolves: Bug 750376 - nss 3.13 breaks sssd TLS- Fix how pem is built so that nss-3.13.x works with nss-softokn-3.12.y- Only patch blapitest for the lack of sha224 on system freebl- Completed the patch to make pem link against system freebl
* Mon Dec 05 2011 Elio Maldonado - 3.13.1-6- Removed unwanted /usr/include/nss3 in front of the normal cflags include path- Removed unnecessary patch dealing with CERTDB_TERMINAL_RECORD, it\'s visible
* Sun Dec 04 2011 Elio Maldonado - 3.13.1-5- Statically link the pem module against system freebl found in buildroot- Disabling sha224-related powerup selftest until we update softokn- Disable sha224 and pss tests which nss-softokn 3.12.x doesn\'t support
* Fri Dec 02 2011 Elio Maldonado Batiz - 3.13.1-4- Rebuild with nss-softokn from 3.12 in the buildroot- Allows the pem module to statically link against 3.12.x freebl- Required for using nss-3.13.x with nss-softokn-3.12.y for a merge inrto rhel git repo- Build will be temprarily placed on buildroot override but not pushed in bodhi
* Fri Nov 04 2011 Elio Maldonado - 3.13.1-2- Fix broken dependencies by updating the nss-util and nss-softokn versions
* Thu Nov 03 2011 Elio Maldonado - 3.13.1-1- Update to NSS_3_13_1_RTM- Update builtin certs to those from NSSCKBI_1_88_RTM
* Sat Oct 15 2011 Elio Maldonado - 3.13-1- Update to NSS_3_13_RTM
* Sat Oct 08 2011 Elio Maldonado - 3.13-0.1.rc0.1- Update to NSS_3_13_RC0
* Wed Sep 14 2011 Elio Maldonado - 3.12.11-3- Fix attempt to free initilized pointer (#717338)- Fix leak on pem_CreateObject when given non-existing file name (#734760)- Fix pem_Initialize to return CKR_CANT_LOCK on multi-treaded calls (#736410)
* Tue Sep 06 2011 Kai Engert - 3.12.11-2- Update builtins certs to those from NSSCKBI_1_87_RTM
* Tue Aug 09 2011 Elio Maldonado - 3.12.11-1- Update to NSS_3_12_11_RTM
* Sat Jul 23 2011 Elio Maldonado - 3.12.10-6- Indicate the provenance of stripped source tarball (#688015)
* Mon Jun 27 2011 Michael Schwendt - 3.12.10-5- Provide virtual -static package to meet guidelines (#609612).
* Fri Jun 10 2011 Elio Maldonado - 3.12.10-4- Enable pluggable ecc support (#712556)- Disable the nssdb write-access-on-read-only-dir tests when user is root (#646045)
* Fri May 20 2011 Dennis Gilmore - 3.12.10-3- make the testsuite non fatal on arm arches
* Tue May 17 2011 Elio Maldonado - 3.12.10-2- Fix crmf hard-coded maximum size for wrapped private keys (#703656)
* Fri May 06 2011 Elio Maldonado - 3.12.10-1- Update to NSS_3_12_10_RTM
* Wed Apr 27 2011 Elio Maldonado - 3.12.10-0.1.beta1- Update to NSS_3_12_10_BETA1
* Mon Apr 11 2011 Elio Maldonado - 3.12.9-15- Implement PEM logging using NSPR\'s own (#695011)
* Wed Mar 23 2011 Elio Maldonado - 3.12.9-14- Update to NSS_3.12.9_WITH_CKBI_1_82_RTM
* Thu Feb 24 2011 Elio Maldonado - 3.12.9-13- Short-term fix for ssl test suites hangs on ipv6 type connections (#539183)
* Fri Feb 18 2011 Elio Maldonado - 3.12.9-12- Add a missing requires for pkcs11-devel (#675196)
* Tue Feb 15 2011 Elio Maldonado - 3.12.9-11- Run the test suites in the check section (#677809)
* Thu Feb 10 2011 Elio Maldonado - 3.12.9-10- Fix cms headers to not use c++ reserved words (#676036)- Reenabling Bug 499444 patches- Fix to swap internal key slot on fips mode switches
* Tue Feb 08 2011 Elio Maldonado - 3.12.9-9- Revert patches for 499444 until all c++ reserved words are found and extirpated
* Tue Feb 08 2011 Fedora Release Engineering - 3.12.9-8- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
* Tue Feb 08 2011 Elio Maldonado - 3.12.9-7- Fix cms header to not use c++ reserved word (#676036)- Reenable patches for bug 499444
* Tue Feb 08 2011 Christopher Aillon - 3.12.9-6- Revert patches for 499444 as they use a C++ reserved word and cause compilation of Firefox to fail
* Fri Feb 04 2011 Elio Maldonado - 3.12.9-5- Fix the earlier infinite recursion patch (#499444)- Remove a header that now nss-softokn-freebl-devel ships
* Tue Feb 01 2011 Elio Maldonado - 3.12.9-4- Fix infinite recursion when encoding NSS enveloped/digested data (#499444)
* Mon Jan 31 2011 Elio Maldonado - 3.12.9-3- Update the cacert trust patch per upstream review requests (#633043)
* Wed Jan 19 2011 Elio Maldonado - 3.12.9-2- Fix to honor the user\'s cert trust preferences (#633043)- Remove obsoleted patch
* Wed Jan 12 2011 Elio Maldonado - 3.12.9-1- Update to 3.12.9
* Mon Dec 27 2010 Elio Maldonado - 3.12.9-0.1.beta2- Rebuilt according to fedora pre-release package naming guidelines
* Fri Dec 10 2010 Elio Maldonado - 3.12.8.99.2-1- Update to NSS_3_12_9_BETA2- Fix libpnsspem crash when cacert dir contains other directories (#642433)
* Wed Dec 08 2010 Elio Maldonado - 3.12.8.99.1-1- Update to NSS_3_12_9_BETA1 | |
