[Python-Dev] Issue 21671: CVE-2014-0224 OpenSSL upgrade to 1.0.1h on Windows required

[Yates, Andy (CS Houston, TX)]

Python Dev,
Andy here. I have a Windows product based on Python and I'm getting hammered to release a version that includes the fix in OpenSSL 1.0.1h.  My product is built on a Windows system using Python installed from the standard Python installer at Python.org.  I would be grateful if I could get some advice on my options. Will Python.org be releasing a Windows installer with the fix any time soon or will it be at the next scheduled release in November?  If it is November, there's no way I can wait that long. Now what?  Would it be best to build my own Python? Is it possible to drop in new OpenSSL versions on Windows without rebuilding Python?  Looking for some guidance on how to handle these OpenSSL issues on Windows.

Thanks!
Andy Yates
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/python-dev/attachments/20140617/6449bebd/attachment.html>