index.rst (7301B)
1 .. _mozilla_projects_nss_jss_4_3_1_release_notes: 2 3 4.3.1 Release Notes 4 =================== 5 6 .. _release_date_2009-12-02: 7 8 `Release Date: 2009-12-02 <#release_date_2009-12-02>`__ 9 ------------------------------------------------------- 10 11 .. container:: 12 13 `Introduction <#introduction>`__ 14 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 15 16 .. container:: 17 18 Network Security Services for Java (JSS) 4.3.1 is a minor release with the following new 19 features: 20 21 - Support for SSL3 & TLS Renegotiation Vulnerability 22 - Support to explicitly set the key usage for the generated private key 23 24 JSS 4.3.1 is `tri-licensed <https://www.mozilla.org/MPL>`__ under MPL 1.1/GPL 2.0/LGPL 2.1. 25 26 .. _new_in_jss_4.3.1: 27 28 `New in JSS 4.3.1 <#new_in_jss_4.3.1>`__ 29 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 30 31 .. container:: 32 33 A list of bug fixes and enhancement requests were implemented in this release can be obtained by 34 running this `bugzilla 35 query <http://bugzilla.mozilla.org/buglist.cgi?product=JSS&target_milestone=4.3.1&target_milestone=4.3.1&bug_status=RESOLVED&resolution=FIXED>`__ 36 37 **JSS 4.3.1 requires :ref:`mozilla_projects_nss_3_12_5_release_notes` or higher.** 38 39 .. rubric:: SSL3 & TLS Renegotiation Vulnerability 40 :name: ssl3_tls_renegotiation_vulnerability 41 42 See `CVE-2009-3555 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555>`__ and `US-CERT 43 VU#120541 <http://www.kb.cert.org/vuls/id/120541>`__ for more information about this security 44 vulnerability. 45 46 All SSL/TLS renegotiation is disabled by default in NSS 3.12.5 and therefore will be disabled by 47 default with JSS 4.3.1. This will cause programs that attempt to perform renegotiation to 48 experience failures where they formerly experienced successes, and is necessary for them to not 49 be vulnerable, until such time as a new safe renegotiation scheme is standardized by the IETF. 50 51 If an application depends on renegotiation feature, it can be enabled by setting the environment 52 variable NSS_SSL_ENABLE_RENEGOTIATION to 1. By setting this environmental variable, the fix 53 provided by these patches will have no effect and the application may become vulnerable to the 54 issue. 55 56 This default setting can also be changed within the application by using the following JSS 57 methods: 58 59 - SSLServerSocket.enableRenegotiation(int mode) 60 - SSLSocket.enableRenegotiation(int mode) 61 - SSLSocket.enableRenegotiationDefault(int mode) 62 63 The mode of renegotiation that the peer must use can be set to the following: 64 65 - SSLSocket.SSL_RENEGOTIATE_NEVER - Never renegotiate at all. (Default) 66 - SSLSocket.SSL_RENEGOTIATE_UNRESTRICTED - Renegotiate without 67 restriction, whether or not the peer's client hello bears the 68 renegotiation info extension (like we always did in the past). 69 - SSLSocket.SSL_RENEGOTIATE_REQUIRES_XTN - NOT YET IMPLEMENTED 70 71 .. rubric:: Explicitly set the key usage for the generated private key 72 :name: explicitly_set_the_key_usage_for_the_generated_private_key 73 74 | In PKCS #11, each keypair can be marked with the operations it will 75 | be used to perform. Some tokens require that a key be marked for 76 | an operation before the key can be used to perform that operation; 77 | other tokens don't care. NSS/JSS provides a way to specify a set of 78 | flags and a corresponding mask for these flags. 79 80 - see generateECKeyPairWithOpFlags 81 - see generateRSAKeyPairWithOpFlags 82 - see generateDSAKeyPairWithOpFlags 83 84 85 86 `Distribution Information <#distribution_information>`__ 87 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 88 89 .. container:: 90 91 - JSS is checked into ``mozilla/security/jss/``. 92 - The CVS tag for the JSS 4.3.1 release is ``JSS_4_3_1_RTM``. 93 - Source tarballs are available from 94 `ftp://ftp.mozilla.org/pub/mozilla.or...-4.3.1.tar.bz2 <ftp://ftp.mozilla.org/pub/mozilla.org/security/jss/releases/JSS_4_3_1_RTM/src/jss-4.3.1.tar.bz2>`__ 95 - Binary releases are no longer available on mozilla. JSS is a JNI library we provide the 96 jss4.jar but expect you to build the JSS's matching JNI shared library. We provide the 97 jss4.jar in case you do not want to obtain your own JCE code signing certificate. JSS is a 98 JCE provider and therefore the jss4.jar must be signed. 99 `ftp://ftp.mozilla.org/pub/mozilla.org/security/jss/releases/JSS_4_3_1_RTM <ftp://ftp.mozilla.org/pub/mozilla.org/security/jss/releases/JSS_4_3_1_RTM/>`__. 100 101 `Documentation <#documentation>`__ 102 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 103 104 .. container:: 105 106 Documentation for JSS 4.3.1 is available as follows: 107 108 - `Build Instructions for JSS 4.3.1 </jss_build_4.3.1.html>`__ 109 - Javadoc `[online] </javadoc>`__ 110 `[zipped] <ftp://ftp.mozilla.org/pub/mozilla.org/security/jss/releases/JSS_4_3_1_RTM/doc/JSS_4_3_1_RTM-doc.zip>`__ 111 - Read the instructions on `using JSS </using_jss.html>`__. 112 - Source may be viewed with a browser (via the MXR tool) at 113 http://mxr.mozilla.org/mozilla/source/security/jss/ 114 - The RUN TIME behavior of JSS can be affected by the 115 :ref:`mozilla_projects_nss_reference_nss_environment_variables`. 116 117 .. _platform_information: 118 119 `Platform Information <#platform_information>`__ 120 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 121 122 .. container:: 123 124 - You can check out the source from CVS by 125 126 .. note:: 127 128 cvs co -r JSS_4_3_1_RTM JSS 129 130 - JSS 4.3.1 works with JDK versions 4 or higher we suggest the latest. 131 132 - JSS 4.3.1 requires :ref:`mozilla_projects_nss_3_12_5` or higher. 133 134 - JSS 4.3.1 requires `NSPR 4.7.1 <https://www.mozilla.org/projects/nspr/release-notes/>`__ or 135 higher. 136 137 - JSS only supports the native threading model (no green threads). 138 139 .. _known_bugs_and_issues: 140 141 `Known Bugs and Issues <#known_bugs_and_issues>`__ 142 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 143 144 .. container:: 145 146 - For a list of reported bugs that have not yet been fixed, `click 147 here. <http://bugzilla.mozilla.org/buglist.cgi?bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&&product=JSS>`__ 148 Note that some bugs may have been fixed since JSS 4.3.1 was released. 149 150 `Compatibility <#compatibility>`__ 151 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 152 153 .. container:: 154 155 - JSS 4.3.1 is backwards compatible with JSS 4.2. Applications compiled against JSS 4.2 will 156 work with JSS 4.3.1. 157 - The 4.3.1 version of libjss4.so/jss4.dll must only be used with jss4.jar. In general, a JSS 158 JAR file must be used with the JSS shared library from the exact same release. 159 - To obtain the version info from the jar file use, 160 "System.out.println(org.mozilla.jss.CryptoManager.JAR_JSS_VERSION)" and to check the shared 161 library: strings libjss4.so \| grep -i header 162 163 `Feedback <#feedback>`__ 164 ~~~~~~~~~~~~~~~~~~~~~~~~ 165 166 .. container:: 167 168 - Bugs discovered should be reported by filing a bug report with 169 `bugzilla <http://bugzilla.mozilla.org/enter_bug.cgi?product=JSS>`__. 170 - You can also give feedback directly to the developers on the Mozilla Cryptography forums... 171 172 - `Mailing list <https://lists.mozilla.org/listinfo/dev-tech-crypto>`__ 173 - `Newsgroup <http://groups.google.com/group/mozilla.dev.tech.crypto>`__ 174 - `RSS feed <http://groups.google.com/group/mozilla.dev.tech.crypto/feeds>`__