diff -Nru openssl-1.1.1/debian/changelog openssl-1.1.1/debian/changelog --- openssl-1.1.1/debian/changelog 2018-12-13 03:02:15.000000000 +0000 +++ openssl-1.1.1/debian/changelog 2019-06-12 00:12:47.000000000 +0100 @@ -1,3 +1,12 @@ +openssl (1.1.1-1ubuntu2.1~18.04.2) bionic; urgency=medium + + * Cherrypick upstream patch to fix ca -spkac output to be text again. + LP: #1828215 + * Cherrypick upstream patch to prevent over long nonces in ChaCha20-Poly1305 + CVE-2019-1543 + + -- Dimitri John Ledkov Wed, 12 Jun 2019 00:12:47 +0100 + openssl (1.1.1-1ubuntu2.1~18.04.1) bionic; urgency=medium * Backport OpenSSL 1.1.1 to 18.04 LTS. LP: #1797386 diff -Nru openssl-1.1.1/debian/patches/69f6b3ceaba493e70e1296880ea6c93e40714f0f.patch openssl-1.1.1/debian/patches/69f6b3ceaba493e70e1296880ea6c93e40714f0f.patch --- openssl-1.1.1/debian/patches/69f6b3ceaba493e70e1296880ea6c93e40714f0f.patch 1970-01-01 01:00:00.000000000 +0100 +++ openssl-1.1.1/debian/patches/69f6b3ceaba493e70e1296880ea6c93e40714f0f.patch 2019-06-12 00:12:44.000000000 +0100 @@ -0,0 +1,29 @@ +From 69f6b3ceaba493e70e1296880ea6c93e40714f0f Mon Sep 17 00:00:00 2001 +From: Richard Levitte +Date: Thu, 28 Feb 2019 11:30:19 +0100 +Subject: [PATCH] apps/ca.c: only output DER with SPKAC input and when -out is + chosen + +So say the docs + +Fixes #8055 + +Reviewed-by: Matt Caswell +(Merged from https://github.com/openssl/openssl/pull/8368) +--- + apps/ca.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/apps/ca.c b/apps/ca.c +index b4ac86d4aac..4464b2ba86a 100644 +--- a/apps/ca.c ++++ b/apps/ca.c +@@ -722,7 +722,7 @@ int ca_main(int argc, char **argv) + + /*****************************************************************/ + if (req || gencrl) { +- if (spkac_file != NULL) { ++ if (spkac_file != NULL && outfile != NULL) { + output_der = 1; + batch = 1; + } diff -Nru openssl-1.1.1/debian/patches/f426625b6ae9a7831010750490a5f0ad689c5ba3.patch openssl-1.1.1/debian/patches/f426625b6ae9a7831010750490a5f0ad689c5ba3.patch --- openssl-1.1.1/debian/patches/f426625b6ae9a7831010750490a5f0ad689c5ba3.patch 1970-01-01 01:00:00.000000000 +0100 +++ openssl-1.1.1/debian/patches/f426625b6ae9a7831010750490a5f0ad689c5ba3.patch 2019-06-12 00:12:44.000000000 +0100 @@ -0,0 +1,66 @@ +From f426625b6ae9a7831010750490a5f0ad689c5ba3 Mon Sep 17 00:00:00 2001 +From: Matt Caswell +Date: Tue, 5 Mar 2019 14:39:15 +0000 +Subject: [PATCH] Prevent over long nonces in ChaCha20-Poly1305 + +ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for +every encryption operation. RFC 7539 specifies that the nonce value (IV) +should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and +front pads the nonce with 0 bytes if it is less than 12 bytes. However it +also incorrectly allows a nonce to be set of up to 16 bytes. In this case +only the last 12 bytes are significant and any additional leading bytes are +ignored. + +It is a requirement of using this cipher that nonce values are unique. +Messages encrypted using a reused nonce value are susceptible to serious +confidentiality and integrity attacks. If an application changes the +default nonce length to be longer than 12 bytes and then makes a change to +the leading bytes of the nonce expecting the new value to be a new unique +nonce then such an application could inadvertently encrypt messages with a +reused nonce. + +Additionally the ignored bytes in a long nonce are not covered by the +integrity guarantee of this cipher. Any application that relies on the +integrity of these ignored leading bytes of a long nonce may be further +affected. + +Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe +because no such use sets such a long nonce value. However user +applications that use this cipher directly and set a non-default nonce +length to be longer than 12 bytes may be vulnerable. + +CVE-2019-1543 + +Fixes #8345 + +Reviewed-by: Paul Dale +Reviewed-by: Richard Levitte +(Merged from https://github.com/openssl/openssl/pull/8406) + +(cherry picked from commit 2a3d0ee9d59156c48973592331404471aca886d6) +--- + crypto/evp/e_chacha20_poly1305.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/crypto/evp/e_chacha20_poly1305.c b/crypto/evp/e_chacha20_poly1305.c +index c1917bb86a6..d3e2c622a1b 100644 +--- a/crypto/evp/e_chacha20_poly1305.c ++++ b/crypto/evp/e_chacha20_poly1305.c +@@ -30,6 +30,8 @@ typedef struct { + + #define data(ctx) ((EVP_CHACHA_KEY *)(ctx)->cipher_data) + ++#define CHACHA20_POLY1305_MAX_IVLEN 12 ++ + static int chacha_init_key(EVP_CIPHER_CTX *ctx, + const unsigned char user_key[CHACHA_KEY_SIZE], + const unsigned char iv[CHACHA_CTR_SIZE], int enc) +@@ -533,7 +535,7 @@ static int chacha20_poly1305_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, + return 1; + + case EVP_CTRL_AEAD_SET_IVLEN: +- if (arg <= 0 || arg > CHACHA_CTR_SIZE) ++ if (arg <= 0 || arg > CHACHA20_POLY1305_MAX_IVLEN) + return 0; + actx->nonce_len = arg; + return 1; diff -Nru openssl-1.1.1/debian/patches/series openssl-1.1.1/debian/patches/series --- openssl-1.1.1/debian/patches/series 2018-12-13 03:02:15.000000000 +0000 +++ openssl-1.1.1/debian/patches/series 2019-06-12 00:12:47.000000000 +0100 @@ -9,3 +9,5 @@ CVE-2018-0734-2.patch CVE-2018-0734-3.patch CVE-2018-0735.patch +69f6b3ceaba493e70e1296880ea6c93e40714f0f.patch +f426625b6ae9a7831010750490a5f0ad689c5ba3.patch