4.3.1 Release Notes¶
Network Security Services for Java (JSS) 4.3.1 is a minor release with the following new features:
Support for SSL3 & TLS Renegotiation Vulnerability
Support to explicitly set the key usage for the generated private key
JSS 4.3.1 is tri-licensed under MPL 1.1/GPL 2.0/LGPL 2.1.
A list of bug fixes and enhancement requests were implemented in this release can be obtained by running this bugzilla query
JSS 4.3.1 requires :ref:`mozilla_projects_nss_3_12_5_release_notes` or higher.
SSL3 & TLS Renegotiation Vulnerability
All SSL/TLS renegotiation is disabled by default in NSS 3.12.5 and therefore will be disabled by default with JSS 4.3.1. This will cause programs that attempt to perform renegotiation to experience failures where they formerly experienced successes, and is necessary for them to not be vulnerable, until such time as a new safe renegotiation scheme is standardized by the IETF.
If an application depends on renegotiation feature, it can be enabled by setting the environment variable NSS_SSL_ENABLE_RENEGOTIATION to 1. By setting this environmental variable, the fix provided by these patches will have no effect and the application may become vulnerable to the issue.
This default setting can also be changed within the application by using the following JSS methods:
The mode of renegotiation that the peer must use can be set to the following:
SSLSocket.SSL_RENEGOTIATE_NEVER - Never renegotiate at all. (Default)
SSLSocket.SSL_RENEGOTIATE_UNRESTRICTED - Renegotiate without restriction, whether or not the peer’s client hello bears the renegotiation info extension (like we always did in the past).
SSLSocket.SSL_RENEGOTIATE_REQUIRES_XTN - NOT YET IMPLEMENTED
Explicitly set the key usage for the generated private key
JSS is checked into
The CVS tag for the JSS 4.3.1 release is
Source tarballs are available from ftp://ftp.mozilla.org/pub/mozilla.or…-4.3.1.tar.bz2
Binary releases are no longer available on mozilla. JSS is a JNI library we provide the jss4.jar but expect you to build the JSS’s matching JNI shared library. We provide the jss4.jar in case you do not want to obtain your own JCE code signing certificate. JSS is a JCE provider and therefore the jss4.jar must be signed. ftp://ftp.mozilla.org/pub/mozilla.org/security/jss/releases/JSS_4_3_1_RTM.
Documentation for JSS 4.3.1 is available as follows:
You can check out the source from CVS by
cvs co -r JSS_4_3_1_RTM JSS
JSS 4.3.1 works with JDK versions 4 or higher we suggest the latest.
JSS 4.3.1 requires mozilla_projects_nss_3_12_5 or higher.
JSS 4.3.1 requires NSPR 4.7.1 or higher.
JSS only supports the native threading model (no green threads).
For a list of reported bugs that have not yet been fixed, click here. Note that some bugs may have been fixed since JSS 4.3.1 was released.
JSS 4.3.1 is backwards compatible with JSS 4.2. Applications compiled against JSS 4.2 will work with JSS 4.3.1.
The 4.3.1 version of libjss4.so/jss4.dll must only be used with jss4.jar. In general, a JSS JAR file must be used with the JSS shared library from the exact same release.
To obtain the version info from the jar file use, “System.out.println(org.mozilla.jss.CryptoManager.JAR_JSS_VERSION)” and to check the shared library: strings libjss4.so | grep -i header