http://www.openssl.org/news/secadv_20140605.txt

All client versions of OpenSSL are vulnerable so all Windows builds of Python are vulnerable to MITM attacks when connecting to vulnerable servers.

2.7, 3.4, and default should be updated; should we do anything for 3.1-3.3 since they will not get any further installers?

This isn't an issue for releases in security-fix mode (3.1, 3.2, 3.3) since there are not changes to Python involved and we do not provide binary installers for releases in that mode.

Might it make sense to special case 3.2 and 3.3 since the last releases of those were not security releases and the security issue is with a bundled library?

We can ask for an opinion from the 3.2 and 3.3 release managers (adding Georg) but I doubt that anyone is going to be interested in producing Windows binary installers for those release plus we haven't done this for 3.2.x for recent previous OpenSSL CVE's, have we?

New changeset 3dfdcc97250f by Zachary Ware in branch '2.7':
Issue #21671, CVE-2014-0224: Update the Windows build to openssl-1.0.1h
http://hg.python.org/cpython/rev/3dfdcc97250f

New changeset 79f3d25caac3 by Zachary Ware in branch '3.4':
Issue #21671, CVE-2014-0224: Update the Windows build to openssl-1.0.1h
http://hg.python.org/cpython/rev/79f3d25caac3

New changeset a32ced15b883 by Zachary Ware in branch 'default':
Issue #21671: Merge with 3.4
http://hg.python.org/cpython/rev/a32ced15b883

Martin, would you make installers for a new 3.2 and 3.3 release?

I'm unsure. I'd rather stick to the established policy. If there are reasons to change the policy, I'd like to know what they are and what a new policy should look like, instead of making a singular exception from the policy.

For the record, the reason *for* the policy is that it reduces maintenance burden; I'm unsure whether I still have the environment to build Python 3.2, for example.

Well, it's entirely logical to follow our own policies :)

So installers are out for 3.1-3.3; should we still update the externals script and pyproject properties for those branches anyway?  If not, this issue should be ready to close.

The only reason to do it is to help out those who build from source, which I suspect is an incredibly small group on Windows. We'd also be signing up to keep doing it, and implying that it's been tested.

I say don't bother.
________________________________
From: Zachary Ware<mailto:report@bugs.python.org>
Sent: ‎6/‎8/‎2014 11:57
To: Steve Dower<mailto:Steve.Dower@microsoft.com>
Subject: [issue21671] CVE-2014-0224: OpenSSL upgrade to 1.0.1h on Windows required

Zachary Ware added the comment:

So installers are out for 3.1-3.3; should we still update the externals script and pyproject properties for those branches anyway?  If not, this issue should be ready to close.

----------
stage:  -> commit review
status: open -> pending
type:  -> security

_______________________________________
Python tracker <report@bugs.python.org>
<http://bugs.python.org/issue21671>
_______________________________________

Good enough for me.