Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV attack...

diff --cc Misc/NEWS
index 45ded061847e4d126dd4a19e33abbe35d7745873,8a85fe440943407feb5c6f694dd1b553d4530005..02b7a64a3a50b07747e5e21b453ea8a432b28139
--- 1/Misc/NEWS
--- 2/Misc/NEWS
+++ b/Misc/NEWS
@@@ -461,17 -111,9 +461,20 @@@ Core and Builtin
  Library
  -------
  
+ - Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC
+   IV attack countermeasure.
+ 
 +- Issue #13847: time.localtime() and time.gmtime() now raise an OSError instead
 +  of ValueError on failure. time.ctime() and time.asctime() now raises an
 +  OSError if localtime() failed. time.clock() now raises a RuntimeError if the
 +  processor time used is not available or its value cannot be represented
 +
 +- Issue #13862: Fix spurious failure in test_zlib due to runtime/compile time
 +  minor versions not matching.
 +
 +- Issue #12804: Fix test_socket and test_urllib2net failures when running tests
 +  on a system without internet access.
 +
  - Issue #13772: In os.symlink() under Windows, do not try to guess the link
    target's type (file or directory).  The detection was buggy and made the
    call non-atomic (therefore prone to race conditions).

diff --cc Modules/_ssl.c
Simple merge