Two vulnerabilities in the ssl module

How it was found

I found two vulnerabilities in python's ssl module.

The first is a Py_XDECREF call on an object which isn't owned, leading to use-after-free and/or double free scenarios. The second vulnerability is an uninitialized variable use.

I described both issues in detail in a mail to the PSRT. The mail and fix for both issues is here:

https://bugs.python.org/issue27773