[Python-checkins] cpython: What's New in Python 3.4: Security improvements
victor.stinner
python-checkins at python.org
Tue Mar 11 13:17:40 CET 2014
http://hg.python.org/cpython/rev/16384988a526
changeset: 89581:16384988a526
parent: 89579:14c1ff6a8086
user: Victor Stinner <victor.stinner at gmail.com>
date: Tue Mar 11 13:17:30 2014 +0100
summary:
What's New in Python 3.4: Security improvements
files:
Doc/library/multiprocessing.rst | 2 +-
Doc/whatsnew/3.4.rst | 30 ++++++++++++++++++--
2 files changed, 28 insertions(+), 4 deletions(-)
diff --git a/Doc/library/multiprocessing.rst b/Doc/library/multiprocessing.rst
--- a/Doc/library/multiprocessing.rst
+++ b/Doc/library/multiprocessing.rst
@@ -137,7 +137,7 @@
over Unix pipes.
.. versionchanged:: 3.4
- *span* added on all unix platforms, and *forkserver* added for
+ *spawn* added on all unix platforms, and *forkserver* added for
some unix platforms.
Child processes no longer inherit all of the parents inheritable
handles on Windows.
diff --git a/Doc/whatsnew/3.4.rst b/Doc/whatsnew/3.4.rst
--- a/Doc/whatsnew/3.4.rst
+++ b/Doc/whatsnew/3.4.rst
@@ -124,8 +124,6 @@
* :ref:`Single-dispatch generic functions <whatsnew-singledispatch>` in
:mod:`functools` (:pep:`443`).
* New :mod:`pickle` :ref:`protocol 4 <whatsnew-protocol-4>` (:pep:`3154`).
-* :ref:`TLSv1.1 and TLSv1.2 support <whatsnew-tls-11-12>` for :mod:`ssl`
- (:issue:`16692`).
* :mod:`multiprocessing` now has :ref:`an option to avoid using os.fork
on Unix <whatsnew-multiprocessing-no-fork>` (:issue:`8713`).
* :mod:`email` has a new submodule, :mod:`~email.contentmanager`, and
@@ -136,6 +134,26 @@
correct introspection of a much wider variety of callable objects
* The :mod:`ipaddress` module API has been declared stable
+Security improvements:
+
+* :ref:`Secure and interchangeable hash algorithm <whatsnew-pep-456>`
+ (:pep:`456`).
+* :ref:`Make newly created file descriptors non-inheritable <whatsnew-pep-446>`
+ (:pep:`446`) to avoid leaking file descriptors to child processes.
+* A new :func:`hashlib.pbkdf2_hmac` function provides
+ the `PKCS#5 password-based key derivation function 2
+ <http://en.wikipedia.org/wiki/PBKDF2>`_.
+* :ref:`TLSv1.1 and TLSv1.2 support <whatsnew-tls-11-12>` for :mod:`ssl`.
+* :ref:`Retrieving certificates from the Windows system cert store support
+ <whatsnew34-win-cert-store>` for :mod:`ssl`.
+* :ref:`Server-side SNI (Server Name Indication) support
+ <whatsnew34-sni>` for :mod:`ssl`.
+* The :class:`ssl.SSLContext` class got a :ref:`lot of improvements
+ <whatsnew34-sslcontext>`.
+* :mod:`multiprocessing` now has :ref:`an option to avoid using os.fork
+ on Unix <whatsnew-multiprocessing-no-fork>`: *spawn* and *forkserver* avoid
+ sharing data with child processes; child processes no longer inherit all of
+ the parents inheritable handles on Windows.
CPython implementation improvements:
@@ -1364,6 +1382,8 @@
Python is linked with OpenSSL 1.0.1 or later. (Contributed by Michele Orrù and
Antoine Pitrou in :issue:`16692`)
+.. _whatsnew34-sslcontext:
+
:class:`~ssl.SSLContext` method :meth:`~ssl.SSLContext.load_verify_locations`
accepts a new optional argument *cadata*, which can be used to provide PEM or
DER encoded certificates directly via strings or bytes, respectively.
@@ -1383,12 +1403,16 @@
list of the loaded ``CA`` certificates. (Contributed by Christian Heimes in
and :issue:`18147`.)
+.. _whatsnew34-win-cert-store:
+
Two new windows-only functions, :func:`~ssl.enum_certificates` and
:func:`~ssl.enum_crls` provide the ability to retrieve certificates,
certificate information, and CRLs from the Windows cert store. (Contributed
by Christian Heimes in :issue:`17134`.)
-Support for server-side SNI using the new
+.. _whatsnew34-sni:
+
+Support for server-side SNI (Server Name Indication) using the new
:meth:`ssl.SSLContext.set_servername_callback` method.
(Contributed by Daniel Black in :issue:`8109`.)
--
Repository URL: http://hg.python.org/cpython
More information about the Python-checkins
mailing list