From: Senthil Kumaran <senthil@uthcode.com>
Date: Sun, 31 Jul 2016 06:48:19 +0000 (-0700)
Subject: merge heads
X-Git-Tag: v3.6.0a4~85^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=7bfbd1d3c56b2a5281edeb7a8e21598618b7c1a3;p=python

merge heads
---

7bfbd1d3c56b2a5281edeb7a8e21598618b7c1a3
diff --cc Misc/NEWS
index 0a6ddf49c0,efe9b28874..ffd647113e
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@@ -34,8 -34,10 +34,12 @@@ Core and Builtin
  Library
  -------
  
+ - Issue #27568: Prevent HTTPoxy attack (CVE-2016-1000110). Ignore the
+   HTTP_PROXY variable when REQUEST_METHOD environment is set, which indicates
+   that the script is in CGI mode.
+ 
 +- Issue #27656: Do not assume sched.h defines any SCHED_* constants.
 +
  - Issue #27130: In the "zlib" module, fix handling of large buffers
    (typically 4 GiB) when compressing and decompressing.  Previously, inputs
    were limited to 4 GiB, and compression and decompression operations did not