mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-31 05:58:33 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

ssl.create_default_context() sets OP_NO_COMPRESSION to prevent CRIME

Browse source
This commit is contained in:
Christian Heimes 2013-11-28 08:06:54 +01:00
parent 50a5dad608
commit dec813f118
2 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Lib/ssl.py
View file

@ -383,6 +383,8 @@ def create_default_context(purpose=Purpose.SERVER_AUTH, *, cafile=None,
context = SSLContext(PROTOCOL_TLSv1)
# SSLv2 considered harmful.
context.options |= OP_NO_SSLv2
# disable compression to prevent CRIME attacks (OpenSSL 1.0+)
context.options |= getattr(_ssl, "OP_NO_COMPRESSION", 0)
# disallow ciphers with known vulnerabilities
context.set_ciphers(_RESTRICTED_CIPHERS)
# verify certs in client mode

2
Misc/NEWS
View file

@ -18,6 +18,8 @@ Core and Builtins
Library
-------
- ssl.create_default_context() sets OP_NO_COMPRESSION to prevent CRIME.
- Issue #19802: Add socket.SO_PRIORITY.
- Issue #11508: Fixed uuid.getnode() and uuid.uuid1() on environment with