mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-09-26 18:29:57 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV attack countermeasure.

Browse source
This commit is contained in:
Antoine Pitrou 2012-01-27 09:53:29 +01:00
commit 9e2e5329dc
2 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Misc/NEWS
View file

@ -461,6 +461,9 @@ Core and Builtins
Library Library
------- -------
- Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC
IV attack countermeasure.
- Issue #13847: time.localtime() and time.gmtime() now raise an OSError instead - Issue #13847: time.localtime() and time.gmtime() now raise an OSError instead
of ValueError on failure. time.ctime() and time.asctime() now raises an of ValueError on failure. time.ctime() and time.asctime() now raises an
OSError if localtime() failed. time.clock() now raises a RuntimeError if the OSError if localtime() failed. time.clock() now raises a RuntimeError if the

6
Modules/_ssl.c
View file

@ -1566,7 +1566,8 @@ context_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
self->ctx = ctx; self->ctx = ctx;
/* Defaults */ /* Defaults */
SSL_CTX_set_verify(self->ctx, SSL_VERIFY_NONE, NULL); SSL_CTX_set_verify(self->ctx, SSL_VERIFY_NONE, NULL);
SSL_CTX_set_options(self->ctx, SSL_OP_ALL); SSL_CTX_set_options(self->ctx,
SSL_OP_ALL & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
#define SID_CTX "Python" #define SID_CTX "Python"
SSL_CTX_set_session_id_context(self->ctx, (const unsigned char *) SID_CTX, SSL_CTX_set_session_id_context(self->ctx, (const unsigned char *) SID_CTX,
@ -2533,7 +2534,8 @@ PyInit__ssl(void)
PY_SSL_VERSION_TLS1); PY_SSL_VERSION_TLS1);
/* protocol options */ /* protocol options */
PyModule_AddIntConstant(m, "OP_ALL", SSL_OP_ALL); PyModule_AddIntConstant(m, "OP_ALL",
SSL_OP_ALL & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
PyModule_AddIntConstant(m, "OP_NO_SSLv2", SSL_OP_NO_SSLv2); PyModule_AddIntConstant(m, "OP_NO_SSLv2", SSL_OP_NO_SSLv2);
PyModule_AddIntConstant(m, "OP_NO_SSLv3", SSL_OP_NO_SSLv3); PyModule_AddIntConstant(m, "OP_NO_SSLv3", SSL_OP_NO_SSLv3);
PyModule_AddIntConstant(m, "OP_NO_TLSv1", SSL_OP_NO_TLSv1); PyModule_AddIntConstant(m, "OP_NO_TLSv1", SSL_OP_NO_TLSv1);