From dec813f118f7abffa24a9a0431dea125a6096518 Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Thu, 28 Nov 2013 08:06:54 +0100 Subject: ssl.create_default_context() sets OP_NO_COMPRESSION to prevent CRIME --- Lib/ssl.py | 2 ++ Misc/NEWS | 2 ++ 2 files changed, 4 insertions(+) diff --git a/Lib/ssl.py b/Lib/ssl.py index 72e6a6e..b29b905 100644 --- a/Lib/ssl.py +++ b/Lib/ssl.py @@ -383,6 +383,8 @@ def create_default_context(purpose=Purpose.SERVER_AUTH, *, cafile=None, context = SSLContext(PROTOCOL_TLSv1) # SSLv2 considered harmful. context.options |= OP_NO_SSLv2 + # disable compression to prevent CRIME attacks (OpenSSL 1.0+) + context.options |= getattr(_ssl, "OP_NO_COMPRESSION", 0) # disallow ciphers with known vulnerabilities context.set_ciphers(_RESTRICTED_CIPHERS) # verify certs in client mode diff --git a/Misc/NEWS b/Misc/NEWS index 3c82e1a..6411640 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -18,6 +18,8 @@ Core and Builtins Library ------- +- ssl.create_default_context() sets OP_NO_COMPRESSION to prevent CRIME. + - Issue #19802: Add socket.SO_PRIORITY. - Issue #11508: Fixed uuid.getnode() and uuid.uuid1() on environment with -- cgit v0.12