< back to search

shield Recommended update for mozilla-nss
SUSE-SLE-SDK-12-SP2-2018-184

This update for mozilla-nss provides the following fixes: - Change DRBG to use the getrandom() kernel interface instead of /dev/urandom (bsc#1043853). - Add patches for strengthening and FIPS compliance (bsc#1055271, bsc#1049673): * Use getrandom() instead of /dev/random and /dev/urandom where available. * Remove continuous DRBG test. This is no longer required for FIPS compliance. * Add DSA known answer POST. * Add ECDSA known answer POST. * Use FIPS compliant hash length in pairwise consistency check. * Make RSA key generation parameters more strict in order to meet FIPS criteria. * Add DH and ECDH known answer POSTs. * Add KDF135 CAVS test. * Add keywrapping CAVS test. * Add KAS FFC CAVS test. * Add KAS ECC CAVS test. * Restrict number of bytes generated per GCM IV for FIPS compliance. * Add helpers required by new CAVS tests. * Add fixes to make DSA CAVS tests pass. * Add fixes to make RSA CAVS tests pass. * Add constructor POSTs. * Disable weak ciphers in FIPS mode. * Prevent wraparounds in CTR mode. * Clear various sensitive parameters from memory when no longer in use. * Allow TLS 1.0 PRF to work in FIPS mode, even though it relies on MD5, which is otherwise banned. * Use strong random pool (/dev/random or getrandom() with GRND_RANDOM instead of their more dilute counterparts) in FIPS mode. - We allow AESNI by default now. This can be disabled at runtime by defining NSS_DISABLE_HW_AES in the environment. - Export NSS_FORCE_FIPS=1 for build, since this is needed now to prevent NSS from passing -DNSS_NO_INIT_SUPPORT, which disables on-load FIPS POSTs.

cloud_download Downloads

SUSE Linux Enterprise Software Development Kit 12.2 ppc64le
  • Packages
    mozilla-nss
    Network Security Services
    3.29.5-58.9.1 lock src
    mozilla-nss-devel
    Network (Netscape) Security Services development files
    3.29.5-58.9.1 lock rpm
SUSE Linux Enterprise Software Development Kit 12.2 s390x
  • Packages
    mozilla-nss
    Network Security Services
    3.29.5-58.9.1 lock src
    mozilla-nss-devel
    Network (Netscape) Security Services development files
    3.29.5-58.9.1 lock rpm
SUSE Linux Enterprise Software Development Kit 12.2 aarch64
  • Packages
    mozilla-nss
    Network Security Services
    3.29.5-58.9.1 lock src
    mozilla-nss-devel
    Network (Netscape) Security Services development files
    3.29.5-58.9.1 lock rpm
SUSE Linux Enterprise Software Development Kit 12.2 x86_64
  • Packages
    mozilla-nss
    Network Security Services
    3.29.5-58.9.1 lock src
    mozilla-nss-devel
    Network (Netscape) Security Services development files
    3.29.5-58.9.1 lock rpm