Description: disable ciphers vulnerable to CVE-2020-1968
Author: Marc Deslauriers <marc.deslauriers@canonical.com>

--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -967,6 +967,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      128,
      },
 /* Cipher 30 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_DH_DSS_WITH_AES_128_SHA,
@@ -981,7 +982,9 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      128,
      128,
      },
+#endif
 /* Cipher 31 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_DH_RSA_WITH_AES_128_SHA,
@@ -996,6 +999,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      128,
      128,
      },
+#endif
 /* Cipher 32 */
     {
      1,
@@ -1058,6 +1062,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      256,
      },
 /* Cipher 36 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_DH_DSS_WITH_AES_256_SHA,
@@ -1072,8 +1077,10 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      256,
      256,
      },
+#endif
 
 /* Cipher 37 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_DH_RSA_WITH_AES_256_SHA,
@@ -1088,6 +1095,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      256,
      256,
      },
+#endif
 
 /* Cipher 38 */
     {
@@ -1187,6 +1195,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      },
 
     /* Cipher 3E */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_DH_DSS_WITH_AES_128_SHA256,
@@ -1201,8 +1210,10 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      128,
      128,
      },
+#endif
 
     /* Cipher 3F */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_DH_RSA_WITH_AES_128_SHA256,
@@ -1217,6 +1228,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      128,
      128,
      },
+#endif
 
     /* Cipher 40 */
     {
@@ -1254,6 +1266,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      },
 
     /* Cipher 42 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
@@ -1268,8 +1281,10 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      128,
      128,
      },
+#endif
 
     /* Cipher 43 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
@@ -1284,6 +1299,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      128,
      128,
      },
+#endif
 
     /* Cipher 44 */
     {
@@ -1479,6 +1495,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      },
 
     /* Cipher 68 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_DH_DSS_WITH_AES_256_SHA256,
@@ -1493,8 +1510,10 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      256,
      256,
      },
+#endif
 
     /* Cipher 69 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_DH_RSA_WITH_AES_256_SHA256,
@@ -1509,6 +1528,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      256,
      256,
      },
+#endif
 
     /* Cipher 6A */
     {
@@ -1648,6 +1668,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      256,
      },
     /* Cipher 85 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
@@ -1662,8 +1683,10 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      256,
      256,
      },
+#endif
 
     /* Cipher 86 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
@@ -1678,6 +1701,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      256,
      256,
      },
+#endif
 
     /* Cipher 87 */
     {
@@ -1818,6 +1842,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      },
 
     /* Cipher 97 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_DH_DSS_WITH_SEED_SHA,
@@ -1832,8 +1857,10 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      128,
      128,
      },
+#endif
 
     /* Cipher 98 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_DH_RSA_WITH_SEED_SHA,
@@ -1848,6 +1875,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      128,
      128,
      },
+#endif
 
     /* Cipher 99 */
     {
@@ -1966,6 +1994,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      },
 
     /* Cipher A0 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_DH_RSA_WITH_AES_128_GCM_SHA256,
@@ -1980,8 +2009,10 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      128,
      128,
      },
+#endif
 
     /* Cipher A1 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_DH_RSA_WITH_AES_256_GCM_SHA384,
@@ -1996,6 +2027,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      256,
      256,
      },
+#endif
 
     /* Cipher A2 */
     {
@@ -2030,6 +2062,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      },
 
     /* Cipher A4 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_DH_DSS_WITH_AES_128_GCM_SHA256,
@@ -2044,8 +2077,10 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      128,
      128,
      },
+#endif
 
     /* Cipher A5 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_DH_DSS_WITH_AES_256_GCM_SHA384,
@@ -2060,6 +2095,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]
      256,
      256,
      },
+#endif
 
     /* Cipher A6 */
     {