Emma Smith

The `ssl` module fails to distrust known compromised intermediate certificates. To address this, a denylist of compromised certificates has been implemented to ensure that these certificates are automatically rejected, regardless of the `SSLContext` policy configuration, even when certificate revocation is not configured.

`bz2.BZ2Decompressor` objects can be reused following a decompression error. If an application catches the resulting `OSError` and attempts to retry using the same decompressor, specially crafted input may cause the decompressor to resume from an invalid internal state. This leads to out-of-bounds writes to a stack buffer, which can result in a process crash when processing untrusted data.