Merge the patch for issue #21013 into default

diff --cc Misc/NEWS
index 7a2e4fed24cd86f2e3383d238c6f9a86e3e9bc8b,dfdd194ecf98623a6e22fdc316eabad688a67c88..8657f5a75222f6433b6154a2c01fd8b86f74b876
--- 1/Misc/NEWS
--- 2/Misc/NEWS
+++ b/Misc/NEWS
@@@ -26,9 -24,9 +26,12 @@@ Core and Builtin
  Library
  -------
  
+ - Issue #21013: Enhance ssl.create_default_context() when used for server side
+   sockets to provide better security by default.
+ 
 +- Issue #20145: `assertRaisesRegex` and `assertWarnsRegex` now raise a
 +  TypeError if the second argument is not a string or compiled regex.
 +
  - Issue #20633: Replace relative import by absolute import.
  
  - Issue #20980: Stop wrapping exception when using ThreadPool.