From f2bf8a6ac51530e14d798a03c8e950dd934d85cd Mon Sep 17 00:00:00 2001 From: Antoine Pitrou Date: Fri, 27 Jan 2012 09:48:47 +0100 Subject: Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV attack countermeasure. --- Misc/NEWS | 3 +++ Modules/_ssl.c | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/Misc/NEWS b/Misc/NEWS index b14e169..b70b097 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -13,6 +13,9 @@ Core and Builtins Library ------- +- Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC + IV attack countermeasure. + - Issue #11603: Fix a crash when __str__ is rebound as __repr__. Patch by Andreas Stührk. diff --git a/Modules/_ssl.c b/Modules/_ssl.c index 8ebdc9b..16fbb4d 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -365,7 +365,8 @@ newPySSLObject(PySocketSockObject *Sock, char *key_file, char *cert_file, } /* ssl compatibility */ - SSL_CTX_set_options(self->ctx, SSL_OP_ALL); + SSL_CTX_set_options(self->ctx, + SSL_OP_ALL & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS); verification_mode = SSL_VERIFY_NONE; if (certreq == PY_SSL_CERT_OPTIONAL) -- cgit v0.12