From: Benjamin Peterson <benjamin@python.org>
Date: Thu, 12 Nov 2015 06:45:22 +0000 (-0800)
Subject: merge 3.4 (#25530)
X-Git-Tag: v3.5.1rc1~58
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=45bde5d2ee58ac4887b034569c2ee930b3cfb8af;p=thirdparty%2FPython%2Fcpython.git

merge 3.4 (#25530)
---

45bde5d2ee58ac4887b034569c2ee930b3cfb8af
diff --cc Lib/test/test_ssl.py
index f314ff41daf2,a44054cc75dc..548feebb82ae
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@@ -2451,19 -2172,19 +2451,19 @@@ else
                              " SSL2 client to SSL23 server test unexpectedly failed:\n %s\n"
                              % str(x))
              if hasattr(ssl, 'PROTOCOL_SSLv3'):
-                 try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv3, 'SSLv3')
+                 try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv3, False)
              try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv23, True)
 -            try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1, True)
 +            try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1, 'TLSv1')
  
              if hasattr(ssl, 'PROTOCOL_SSLv3'):
-                 try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv3, 'SSLv3', ssl.CERT_OPTIONAL)
+                 try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv3, False, ssl.CERT_OPTIONAL)
              try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv23, True, ssl.CERT_OPTIONAL)
 -            try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1, True, ssl.CERT_OPTIONAL)
 +            try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1, 'TLSv1', ssl.CERT_OPTIONAL)
  
              if hasattr(ssl, 'PROTOCOL_SSLv3'):
-                 try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv3, 'SSLv3', ssl.CERT_REQUIRED)
+                 try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv3, False, ssl.CERT_REQUIRED)
              try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv23, True, ssl.CERT_REQUIRED)
 -            try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1, True, ssl.CERT_REQUIRED)
 +            try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1, 'TLSv1', ssl.CERT_REQUIRED)
  
              # Server with specific SSL options
              if hasattr(ssl, 'PROTOCOL_SSLv3'):
diff --cc Misc/NEWS
index 85dd15864acc,89f6d83c6929..c79ac83383fe
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@@ -217,26 -208,6 +217,29 @@@ Librar
  - Issue #16180: Exit pdb if file has syntax error, instead of trapping user
    in an infinite loop.  Patch by Xavier de Gaye.
  
 +- Issue #24891: Fix a race condition at Python startup if the file descriptor
 +  of stdin (0), stdout (1) or stderr (2) is closed while Python is creating
 +  sys.stdin, sys.stdout and sys.stderr objects. These attributes are now set
 +  to None if the creation of the object failed, instead of raising an OSError
 +  exception. Initial patch written by Marco Paolini.
 +
 +- Issue #24992: Fix error handling and a race condition (related to garbage
 +  collection) in collections.OrderedDict constructor.
 +
 +- Issue #24881: Fixed setting binary mode in Python implementation of FileIO
 +  on Windows and Cygwin.  Patch from Akira Li.
 +
++- Issue #25530: Disable the vulnerable SSLv3 protocol by default when creating
++  ssl.SSLContext.
++
 +- Issue #25569: Fix memory leak in SSLSocket.getpeercert().
 +
 +- Issue #25471: Sockets returned from accept() shouldn't appear to be
 +  nonblocking.
 +
 +- Issue #25319: When threading.Event is reinitialized, the underlying condition
 +  should use a regular lock rather than a recursive lock.
 +
  - Issue #21112: Fix regression in unittest.expectedFailure on subclasses.
    Patch from Berker Peksag.