Bug#888831: [firefox-esr] NS_ERROR_NET_INADEQUATE_SECURITY for https sites - libnss3 dependency

[Philipp Klaus Krause]

Package: firefox-esr
Version: 52.6.0esr-2
Severity: grave

--- Please enter the report below this line. ---

After upgrading firefox-esr today, it now refuses to access any https
sites (e.g. google, bing are affected, including the results from the
search bar in firefox itself). I get an error message

NS_ERROR_NET_INADEQUATE_SECURITY

This is with libnss3 2:3.33-1.

firefox-esr seems to work normally with libnss3 2:3.34.1-1. So I guess
the bug is in the dependency on the libnss3 version.

--- System information. ---
Architecture: Kernel:       Linux 4.14.0-2-amd64

Debian Release: buster/sid
  500 unstable        ftp.de.debian.org   500 testing
ftp.de.debian.org     1 experimental    ftp.de.debian.org
--- Package information. ---
Depends                              (Version) | Installed
==============================================-+-==================
libasound2                         (>= 1.0.16) | libatk1.0-0
           (>= 1.12.4) | libc6                                (>= 2.17)
| libcairo-gobject2                  (>= 1.10.0) | libcairo2
             (>= 1.10.0) | libdbus-1-3                        (>=
1.9.14) | libdbus-glib-1-2                     (>= 0.78) |
libevent-2.1-6               (>= 2.1.8-stable) | libffi6
            (>= 3.0.4) | libfontconfig1                       (>= 2.12)
| libfreetype6                        (>= 2.2.1) | libgcc1
              (>= 1:4.0) | libgdk-pixbuf2.0-0                 (>=
2.22.0) | libglib2.0-0                       (>= 2.31.8) | libgtk-3-0
                      (>= 3.0.0) | libgtk2.0-0
(>= 2.10) | libhunspell-1.6-0                              | libjsoncpp1
                        (>= 1.7.4) | libnspr4
(>= 2:4.10.9) | libnss3                            (>= 2:3.28) |
libpango-1.0-0                     (>= 1.14.0) | libsqlite3-0
           (>= 3.14.0) | libstartup-notification0              (>= 0.8)
| libstdc++6                            (>= 5.2) | libvpx4
              (>= 1.6.0) | libx11-6
 | libx11-xcb1                                    | libxcb-shm0
                          | libxcb1
  | libxcomposite1                    (>= 1:0.3-1) | libxdamage1
                (>= 1:1.1) | libxext6
   | libxfixes3                                     | libxrender1
                            | libxt6
    | zlib1g                          (>= 1:1.2.3.4) | fontconfig
                             | procps
     | debianutils                          (>= 1.16) |

Package's Recommends field is empty.

Suggests              (Version) | Installed
===============================-+-===========
fonts-stix                      | 1.1.1-4
 OR otf-stix                    | fonts-lmodern                   |
2.004.5-3
mozplugger                      | libgssapi-krb5-2                |  OR
libkrb53                    | libcanberra0                    |


--- Output from package bug script ---

-- Extensions information
Name: Adblock Plus
Location: /{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
Status: enabled

Name: Application Update Service Helper
Location: /aushelper at mozilla.org.xpi
Status: enabled

Name: Deutsch (DE) Language Pack locale
Location:
/usr/lib/firefox-esr/browser/extensions/langpack-de at firefox-esr.mozilla.org.xpi
Package: firefox-esr-l10n-de
Status: enabled

Name: English (GB) Language Pack locale
Location:
/usr/lib/firefox-esr/browser/extensions/langpack-en-GB at firefox-esr.mozilla.org.xpi
Package: firefox-esr-l10n-en-gb
Status: enabled

Name: Fran??ais Language Pack locale
Location:
/usr/lib/firefox-esr/browser/extensions/langpack-fr at firefox-esr.mozilla.org.xpi
Package: firefox-esr-l10n-fr
Status: enabled

Name: Multi-process staged rollout
Location: /e10srollout at mozilla.org.xpi
Status: enabled

Name: Pocket
Location: /firefox at getpocket.com.xpi
Status: enabled

Name: Standard theme
Location:
/usr/lib/firefox-esr/browser/extensions/{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi
Package: firefox-esr
Status: enabled

Name: Web Compat
Location: /webcompat at mozilla.org.xpi
Status: enabled

-- Plugins information
Name: IcedTea-Web Plugin (using IcedTea-Web 1.6.2 (1.6.2-3.1))
Location: /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/amd64/IcedTeaPlugin.so
Package: icedtea-8-plugin:amd64
Status: enabled


-- Addons package information
ii  firefox-esr    52.6.0esr-2  amd64        Mozilla Firefox web browser
- Ext
ii  firefox-esr-l1 52.6.0esr-2  all          German language package for
Firef
ii  firefox-esr-l1 52.6.0esr-2  all          English (United Kingdom)
language
ii  firefox-esr-l1 52.6.0esr-2  all          French language package for
Firef
ii  icedtea-8-plug 1.6.2-3.1    amd64        web browser plugin based on
OpenJ