Re: [Python-Dev] Issue 21671: CVE-2014-0224 OpenSSL upgrade to 1.0.1h on Windows required

2014-06-18 Thread Cory Benfield
On 17 June 2014 17:41, Yates, Andy (CS Houston, TX) aya...@hp.com wrote: Is it possible to drop in new OpenSSL versions on Windows without rebuilding Python? If you think this is a problem you're going to have more than once, you'll want to look hard at whether it's worth using pyOpenSSL

Re: [Python-Dev] Issue 21671: CVE-2014-0224 OpenSSL upgrade to 1.0.1h on Windows required

2014-06-18 Thread Martin v. Löwis
Am 17.06.14 18:41, schrieb Yates, Andy (CS Houston, TX): Python Dev, Andy here. I have a Windows product based on Python and I’m getting hammered to release a version that includes the fix in OpenSSL 1.0.1h. My product is built on a Windows system using Python installed from the standard

Re: [Python-Dev] Issue 21671: CVE-2014-0224 OpenSSL upgrade to 1.0.1h on Windows required

2014-06-18 Thread Martin v. Löwis
Am 17.06.14 20:27, schrieb Steve Dower: You'll only need to rebuild the _ssl and _hashlib extension modules with the new OpenSSL version. The easiest way to do this is to build from source (which has already been updated for 1.0.1h if you use the externals scripts in Tools\buildbot), and you

Re: [Python-Dev] Issue 21671: CVE-2014-0224 OpenSSL upgrade to 1.0.1h on Windows required

2014-06-18 Thread Steve Dower
Yeah, the fact that it really has to be our own copy of the DLL negates the advantage. If someone can rebuild that, they could rebuild the modules that statically link it. Cheers, Steve Top-posted from my Windows Phone From: Martin v.