diff options
| author | Antoine Pitrou <solipsis@pitrou.net> | 2012-01-27 09:42:45 +0100 |
|---|---|---|
| committer | Antoine Pitrou <solipsis@pitrou.net> | 2012-01-27 09:42:45 +0100 |
| commit | a2eb0a441158ed50786645ebb0652d1d20bf170a (patch) | |
| tree | fa0c399b4ef28279bf790c82899df14295421aa5 | |
| parent | 43237ce42976309b980ba6f0f7a4ef5fdd6e9e87 (diff) | |
| download | cpython-a2eb0a441158ed50786645ebb0652d1d20bf170a.tar.gz | |
Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV attack countermeasure.
| -rw-r--r-- | Misc/NEWS | 3 | ||||
| -rw-r--r-- | Modules/_ssl.c | 3 |
2 files changed, 5 insertions, 1 deletions
@@ -13,6 +13,9 @@ Core and Builtins Library ------- +- Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC + IV attack countermeasure. + What's New in Python 2.6.7? =========================== diff --git a/Modules/_ssl.c b/Modules/_ssl.c index 4619cda600..46f71e858e 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -357,7 +357,8 @@ newPySSLObject(PySocketSockObject *Sock, char *key_file, char *cert_file, } /* ssl compatibility */ - SSL_CTX_set_options(self->ctx, SSL_OP_ALL); + SSL_CTX_set_options(self->ctx, + SSL_OP_ALL & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS); verification_mode = SSL_VERIFY_NONE; if (certreq == PY_SSL_CERT_OPTIONAL) |