diff -Nru uw-imap-2007f~dfsg/debian/changelog uw-imap-2007f~dfsg/debian/changelog --- uw-imap-2007f~dfsg/debian/changelog 2019-02-26 23:08:08.000000000 +0000 +++ uw-imap-2007f~dfsg/debian/changelog 2019-08-09 14:51:00.000000000 +0000 @@ -1,3 +1,13 @@ +uw-imap (8:2007f~dfsg-6ubuntu1) eoan; urgency=medium + + * 2014_openssl1.1.1_sni.patch (new): Use SNI when building + with OpenSSL 1.1.1 / TLSv1.3 support, since some servers + (e.g., imap.gmail.com, imap.mail.att.net) require SNI on + TLSv1.3 to pass certificate verification. (LP: #1834340) + * debian/control{,.in{,.in}}: Update maintainer across all. + + -- Mauricio Faria de Oliveira Fri, 09 Aug 2019 11:51:00 -0300 + uw-imap (8:2007f~dfsg-6) unstable; urgency=medium * [CVE-2018-19518] 2013_disable_rsh.patch (new): Disable access to IMAP diff -Nru uw-imap-2007f~dfsg/debian/control uw-imap-2007f~dfsg/debian/control --- uw-imap-2007f~dfsg/debian/control 2019-02-26 23:08:08.000000000 +0000 +++ uw-imap-2007f~dfsg/debian/control 2019-08-09 14:51:00.000000000 +0000 @@ -1,7 +1,8 @@ Source: uw-imap Priority: optional Section: mail -Maintainer: Magnus Holmgren +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Magnus Holmgren Standards-Version: 3.9.8 Build-Depends: cdbs, debhelper, diff -Nru uw-imap-2007f~dfsg/debian/control.in uw-imap-2007f~dfsg/debian/control.in --- uw-imap-2007f~dfsg/debian/control.in 2019-02-26 23:08:08.000000000 +0000 +++ uw-imap-2007f~dfsg/debian/control.in 2019-08-09 14:51:00.000000000 +0000 @@ -1,7 +1,8 @@ Source: uw-imap Priority: optional Section: mail -Maintainer: Magnus Holmgren +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Magnus Holmgren Standards-Version: 3.9.8 Build-Depends: @cdbs@ Vcs-Git: git://git.debian.org/git/collab-maint/uw-imap.git diff -Nru uw-imap-2007f~dfsg/debian/control.in.in uw-imap-2007f~dfsg/debian/control.in.in --- uw-imap-2007f~dfsg/debian/control.in.in 2019-02-26 23:08:08.000000000 +0000 +++ uw-imap-2007f~dfsg/debian/control.in.in 2019-08-09 14:51:00.000000000 +0000 @@ -1,7 +1,8 @@ Source: uw-imap Priority: optional Section: mail -Maintainer: Magnus Holmgren +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Magnus Holmgren Standards-Version: 3.9.8 Build-Depends: @cdbs@ Vcs-Git: git://git.debian.org/git/collab-maint/uw-imap.git diff -Nru uw-imap-2007f~dfsg/debian/patches/2014_openssl1.1.1_sni.patch uw-imap-2007f~dfsg/debian/patches/2014_openssl1.1.1_sni.patch --- uw-imap-2007f~dfsg/debian/patches/2014_openssl1.1.1_sni.patch 1970-01-01 00:00:00.000000000 +0000 +++ uw-imap-2007f~dfsg/debian/patches/2014_openssl1.1.1_sni.patch 2019-08-09 14:51:00.000000000 +0000 @@ -0,0 +1,42 @@ +Bug-Debian: https://bugs.debian.org/916041 +Bug-Ubuntu: https://bugs.launchpad.net/bugs/1834340 +Description: + Google IMAP servers require SNI if TLSv1.3 is used, + otherwise it sends a self-signed certificate which + fails validation. + + OpenSSL support/versions: + - TLSv1.3 on 1.1.1, + - a2i_IPADDRESS() on 0.9.8'ish, + - SSL_set_tlsext_host_name() on 0.9.8'ish/1.0.0; + per 'git blame/describe' and the CHANGES file. + + So check for TLSv1.3 support / OpenSSL 1.1.1 + not to incur behavior changes on pre-TLSv1.3, + and set host_name to 'host' (ssl_open_verify() + validates this, via 'ssl_last_host' variable) + + This patch just combines these two patches: + - BTS#916041 (message #5) by Ed Spiridonov, + - LP#916041 (comment #6) by David Zuelke. +Author: Mauricio Faria de Oliveira + +Index: uw-imap-2007f~dfsg/src/osdep/unix/ssl_unix.c +=================================================================== +--- uw-imap-2007f~dfsg.orig/src/osdep/unix/ssl_unix.c ++++ uw-imap-2007f~dfsg/src/osdep/unix/ssl_unix.c +@@ -266,6 +266,14 @@ static char *ssl_start_work (SSLSTREAM * + /* create connection */ + if (!(stream->con = (SSL *) SSL_new (stream->context))) + return "SSL connection failed"; ++#if OPENSSL_VERSION_NUMBER >= 0x10101000 ++ /* Use SNI in case server requires it with TLSv1.3. ++ * Literal IP addresses not permitted per RFC 6066. */ ++ if (!a2i_IPADDRESS(host)) { ++ ERR_clear_error(); ++ SSL_set_tlsext_host_name(stream->con,host); ++ } ++#endif + bio = BIO_new_socket (stream->tcpstream->tcpsi,BIO_NOCLOSE); + SSL_set_bio (stream->con,bio,bio); + SSL_set_connect_state (stream->con); diff -Nru uw-imap-2007f~dfsg/debian/patches/series uw-imap-2007f~dfsg/debian/patches/series --- uw-imap-2007f~dfsg/debian/patches/series 2019-02-26 23:08:08.000000000 +0000 +++ uw-imap-2007f~dfsg/debian/patches/series 2019-08-09 14:51:00.000000000 +0000 @@ -10,3 +10,4 @@ 1005_poll.patch 1006_openssl1.1_autoverify.patch 2013_disable_rsh.patch +2014_openssl1.1.1_sni.patch