changeset 101887:d590114c2394 3.4

raise an error when STARTTLS fails
author Benjamin Peterson <benjamin@python.org>
date Sat, 11 Jun 2016 13:16:42 -0700
parents 90e58a77d386
children c71c6a3a8097 bb3ce78572f5
files Lib/smtplib.py Misc/NEWS
diffstat 2 files changed, 8 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/Lib/smtplib.py
+++ b/Lib/smtplib.py
@@ -695,6 +695,11 @@ class SMTP:
             self.ehlo_resp = None
             self.esmtp_features = {}
             self.does_esmtp = 0
+        else:
+            # RFC 3207:
+            # 501 Syntax error (no parameters allowed)
+            # 454 TLS not available due to temporary reason
+            raise SMTPResponseException(resp, reply)
         return (resp, reply)
 
     def sendmail(self, from_addr, to_addrs, msg, mail_options=[],
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -19,6 +19,9 @@ Core and Builtins
 Library
 -------
 
+- Fix TLS stripping vulnerability in smptlib, CVE-2016-0772.  Reported by Team
+  Oststrom
+
 - Issue #25939: On Windows open the cert store readonly in ssl.enum_certificates.
 
 - Issue #26012: Don't traverse into symlinks for ** pattern in