mirrors
/
cpython
mirror of https://github.com/python/cpython.git
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV attack countermeasure.

This commit is contained in:
Antoine Pitrou 2012-01-27 09:44:08 +01:00
parent 64b2b6a84d d358e0554b
commit 374b4ea9da
2 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Misc/NEWS
View File

@ -90,6 +90,9 @@ Core and Builtins
Library Library
------- -------
- Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC
IV attack countermeasure.
- Issue #6631: Disallow relative file paths in urllib urlopen methods. - Issue #6631: Disallow relative file paths in urllib urlopen methods.
- Issue #13781: Prevent gzip.GzipFile from using the dummy filename provided by - Issue #13781: Prevent gzip.GzipFile from using the dummy filename provided by

3
Modules/_ssl.c
View File

@ -369,7 +369,8 @@ newPySSLObject(PySocketSockObject *Sock, char *key_file, char *cert_file,
} }
/* ssl compatibility */ /* ssl compatibility */
SSL_CTX_set_options(self->ctx, SSL_OP_ALL); SSL_CTX_set_options(self->ctx,
SSL_OP_ALL & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
verification_mode = SSL_VERIFY_NONE; verification_mode = SSL_VERIFY_NONE;
if (certreq == PY_SSL_CERT_OPTIONAL) if (certreq == PY_SSL_CERT_OPTIONAL)