NSS incorrectly preferring a longer, weaker chain over a shorter, stronger chain

[Cambell Prince]

See:

https://code.google.com/p/chromium/issues/detail?id=437733

and

https://code.google.com/p/chromium/issues/detail?id=459131

This issue is fixed in upstream libnss3 version >= 3.17.4

This issue causes incorrect SHA1 sunset behaviour in Google Chrome.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Marco (bulletxt)]

Please get this fixed, chrome 41 will get out soon and its deprecating sha1 ssl. This library has to be updated! Thanls

[Launchpad Janitor (janitor)]

This bug was fixed in the package nss - 2:3.17.4-0ubuntu1

---------------
nss (2:3.17.4-0ubuntu1) vivid; urgency=medium

  * SECURITY UPDATE: update to upstream 3.17.4 to get new CA certificate
    bundle, and to fix incorrect SHA-1 behaviour. (LP: #1423031)
  * Removed unneeded patches:
    - debian/patches/98_CVE-2014-1569.patch: included upstream.
 -- Marc Deslauriers <email address hidden> Thu, 19 Feb 2015 07:32:50 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package nss - 3.17.4-0ubuntu0.10.04.1

---------------
nss (3.17.4-0ubuntu0.10.04.1) lucid-security; urgency=medium

  * SECURITY UPDATE: update to upstream 3.17.4 to get new CA certificate
    bundle, and to fix incorrect SHA-1 behaviour. (LP: #1423031)
  * Removed unneeded patches:
    - debian/patches/CVE-2014-1569.patch: included upstream.
 -- Marc Deslauriers <email address hidden> Thu, 19 Feb 2015 07:48:44 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package nss - 2:3.17.4-0ubuntu0.14.04.1

---------------
nss (2:3.17.4-0ubuntu0.14.04.1) trusty-security; urgency=medium

  * SECURITY UPDATE: update to upstream 3.17.4 to get new CA certificate
    bundle, and to fix incorrect SHA-1 behaviour. (LP: #1423031)
  * Removed unneeded patches:
    - debian/patches/CVE-2014-1569.patch: included upstream.
 -- Marc Deslauriers <email address hidden> Thu, 19 Feb 2015 07:44:05 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package nss - 2:3.17.4-0ubuntu0.14.10.1

---------------
nss (2:3.17.4-0ubuntu0.14.10.1) utopic-security; urgency=medium

  * SECURITY UPDATE: update to upstream 3.17.4 to get new CA certificate
    bundle, and to fix incorrect SHA-1 behaviour. (LP: #1423031)
  * Removed unneeded patches:
    - debian/patches/CVE-2014-1569.patch: included upstream.
 -- Marc Deslauriers <email address hidden> Thu, 19 Feb 2015 07:41:50 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package nss - 3.17.4-0ubuntu0.12.04.1

---------------
nss (3.17.4-0ubuntu0.12.04.1) precise-security; urgency=medium

  * SECURITY UPDATE: update to upstream 3.17.4 to get new CA certificate
    bundle, and to fix incorrect SHA-1 behaviour. (LP: #1423031)
  * Removed unneeded patches:
    - debian/patches/CVE-2014-1569.patch: included upstream.
 -- Marc Deslauriers <email address hidden> Thu, 19 Feb 2015 07:45:59 -0500

[Cambell Prince (cambell-prince)]

Tested on Trusty and confirmed fixed. Thanks.

- Google Chrome 40.0.2214.115-1
- libnss3 2:3.17.4-0ubuntu0.14.04.1

[Marco (bulletxt)]

tested on Ubuntu 14.04 , great it fixed the problem!

Thanks