Introduction
The NSS team has released Network Security Services (NSS) 3.38, which is a minor release.
Distribution Information
The HG tag is NSS_3_38_RTM. NSS 3.38 requires NSPR 4.19 or newer.
NSS 3.38 source distributions are available on ftp.mozilla.org for secure HTTPS download:
New in NSS 3.38
New Functionality
- Added support for the TLS Record Size Limit Extension.
- When creating a certificate request (CSR) using certutil -R, an existing orphan private key can be reused. Parameter -k may be used to specify the ID of an existing orphan key. The available orphan key IDs can be displayed using command certutil -K.
- When using certutil -O to print the chain for a given certificate nickname, the new parameter --simple-self-signed may be provided, which can avoid ambiguous output in some scenarios.
New Functions
- in secitem.h
- SECITEM_MakeItem - Allocate and make an item with the requested contents
New Macros
- in ssl.h
- SSL_RECORD_SIZE_LIMIT - used to control the TLS Record Size Limit Extension
Notable Changes in NSS 3.38
-
Fixed CVE-2018-0495 in bug 1464971.
-
Various security fixes in the ASN.1 code.
-
NSS automatically enables caching for SQL database storage on Linux, if it is located on a network filesystem that's known to benefit from caching.
-
When repeatedly importing the same certificate into an SQL database, the existing nickname will be kept.
Bugs fixed in NSS 3.38
This Bugzilla query returns all the bugs fixed in NSS 3.38:
Compatibility
NSS 3.38 shared libraries are backward compatible with all older NSS 3.x shared libraries. A program linked with older NSS 3.x shared libraries will work with NSS 3.38 shared libraries without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs to the functions listed in NSS Public Functions will remain compatible with future versions of the NSS shared libraries.
Feedback
Bugs discovered should be reported by filing a bug report with bugzilla.mozilla.org (product NSS).