summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorBenjamin Peterson <benjamin@python.org>2016-06-11 20:18:56 (GMT)
committerBenjamin Peterson <benjamin@python.org>2016-06-11 20:18:56 (GMT)
commitb0557e729e07e63f36d91d1d631424616373a384 (patch)
tree37e065de80b5d6f5165e52c0b67ca4f6ed975cde
parentaf51140fa0f475ed8050a938df6ce0db3c7d607a (diff)
parent46b32f307c48bcb999b22eebf65ffe8ed5cca544 (diff)
downloadcpython-b0557e729e07e63f36d91d1d631424616373a384.zip
cpython-b0557e729e07e63f36d91d1d631424616373a384.tar.gz
cpython-b0557e729e07e63f36d91d1d631424616373a384.tar.bz2
merge 3.4
-rwxr-xr-xLib/smtplib.py5
-rw-r--r--Misc/NEWS3
2 files changed, 8 insertions, 0 deletions
diff --git a/Lib/smtplib.py b/Lib/smtplib.py
index 4756973..dfbf5f9 100755
--- a/Lib/smtplib.py
+++ b/Lib/smtplib.py
@@ -773,6 +773,11 @@ class SMTP:
self.ehlo_resp = None
self.esmtp_features = {}
self.does_esmtp = 0
+ else:
+ # RFC 3207:
+ # 501 Syntax error (no parameters allowed)
+ # 454 TLS not available due to temporary reason
+ raise SMTPResponseException(resp, reply)
return (resp, reply)
def sendmail(self, from_addr, to_addrs, msg, mail_options=[],
diff --git a/Misc/NEWS b/Misc/NEWS
index cc5ba7d..418fd5c 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -139,6 +139,9 @@ Core and Builtins
Library
-------
+- Fix TLS stripping vulnerability in smptlib, CVE-2016-0772. Reported by Team
+ Oststrom
+
- Issue #21386: Implement missing IPv4Address.is_global property. It was
documented since 07a5610bae9d. Initial patch by Roger Luethi.