Blame SOURCES/00305-CVE-2016-2183.patch

90a41a
diff --git a/Lib/ssl.py b/Lib/ssl.py
90a41a
index 038daa4..5311321 100644
90a41a
--- a/Lib/ssl.py
90a41a
+++ b/Lib/ssl.py
90a41a
@@ -143,38 +143,36 @@ if _ssl.HAS_TLS_UNIQUE:
90a41a
 else:
90a41a
     CHANNEL_BINDING_TYPES = []
90a41a
 
90a41a
+
90a41a
 # Disable weak or insecure ciphers by default
90a41a
 # (OpenSSL's default setting is 'DEFAULT:!aNULL:!eNULL')
90a41a
 # Enable a better set of ciphers by default
90a41a
 # This list has been explicitly chosen to:
90a41a
 #   * Prefer cipher suites that offer perfect forward secrecy (DHE/ECDHE)
90a41a
 #   * Prefer ECDHE over DHE for better performance
90a41a
-#   * Prefer any AES-GCM over any AES-CBC for better performance and security
90a41a
+#   * Prefer AEAD over CBC for better performance and security
90a41a
 #   * Then Use HIGH cipher suites as a fallback
90a41a
-#   * Then Use 3DES as fallback which is secure but slow
90a41a
 #   * Finally use RC4 as a fallback which is problematic but needed for
90a41a
 #     compatibility some times.
90a41a
-#   * Disable NULL authentication, NULL encryption, and MD5 MACs for security
90a41a
-#     reasons
90a41a
+#   * Disable NULL authentication, NULL encryption, 3DES and MD5 MACs
90a41a
+#     for security reasons
90a41a
 _DEFAULT_CIPHERS = (
90a41a
     'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+HIGH:'
90a41a
-    'DH+HIGH:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+HIGH:RSA+3DES:ECDH+RC4:'
90a41a
-    'DH+RC4:RSA+RC4:!aNULL:!eNULL:!MD5'
90a41a
+    'DH+HIGH:RSA+AESGCM:RSA+AES:RSA+HIGH:ECDH+RC4:DH+RC4:RSA+RC4:!aNULL:!eNULL:'
90a41a
+    '!MD5:!3DES'
90a41a
 )
90a41a
 
90a41a
 # Restricted and more secure ciphers for the server side
90a41a
 # This list has been explicitly chosen to:
90a41a
 #   * Prefer cipher suites that offer perfect forward secrecy (DHE/ECDHE)
90a41a
 #   * Prefer ECDHE over DHE for better performance
90a41a
-#   * Prefer any AES-GCM over any AES-CBC for better performance and security
90a41a
+#   * Prefer AEAD over CBC for better performance and security
90a41a
 #   * Then Use HIGH cipher suites as a fallback
90a41a
-#   * Then Use 3DES as fallback which is secure but slow
90a41a
-#   * Disable NULL authentication, NULL encryption, MD5 MACs, DSS, and RC4 for
90a41a
-#     security reasons
90a41a
+#   * Disable NULL authentication, NULL encryption, MD5 MACs, DSS, RC4, and
90a41a
+#     3DES for security reasons
90a41a
 _RESTRICTED_SERVER_CIPHERS = (
90a41a
     'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+HIGH:'
90a41a
-    'DH+HIGH:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+HIGH:RSA+3DES:!aNULL:'
90a41a
-    '!eNULL:!MD5:!DSS:!RC4'
90a41a
+    'DH+HIGH:RSA+AESGCM:RSA+AES:RSA+HIGH:!aNULL:!eNULL:!MD5:!DSS:!RC4:!3DES'
90a41a
 )
90a41a
 
90a41a