From: Christian Heimes Date: Fri, 16 Aug 2013 22:55:39 +0000 (+0200) Subject: merge X-Git-Tag: v3.4.0a2~203^2 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a3811e4b8f70790a3dc8768a455cb8836670de37;p=python merge --- a3811e4b8f70790a3dc8768a455cb8836670de37 diff --cc Misc/NEWS index 720eab341a,36860b1efb..b423b8b738 --- a/Misc/NEWS +++ b/Misc/NEWS @@@ -66,12 -66,10 +66,16 @@@ Core and Builtin Library ------- +- Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes + inside subjectAltName correctly. Formerly the module has used OpenSSL's + GENERAL_NAME_print() function to get the string represention of ASN.1 + strings for ``rfc822Name`` (email), ``dNSName`` (DNS) and + ``uniformResourceIdentifier`` (URI). + + - Issue #18756: Improve error reporting in os.urandom() when the failure + is due to something else than /dev/urandom not existing (for example, + exhausting the file descriptor limit). + - Issue #18405: Improve the entropy of crypt.mksalt(). - Issue #18676: Change 'positive' to 'non-negative' in queue.py put and get