diff --git a/Misc/NEWS b/Misc/NEWS
index 0c526df..6b5b455 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -73,6 +73,12 @@
 
 - Issue #20635: Added tests for Tk geometry managers.
 
+Windows
+-------
+
+- Issue #21671, CVE-2014-0224: The bundled version of OpenSSL has been
+  updated to 1.0.1h.
+
 What's New in Python 2.7.7
 ==========================
 
diff --git a/PCbuild/pyproject.vsprops b/PCbuild/pyproject.vsprops
index dfdc556..0dd61e5 100644
--- a/PCbuild/pyproject.vsprops
+++ b/PCbuild/pyproject.vsprops
@@ -82,7 +82,7 @@
 	/>
 	<UserMacro
 		Name="opensslDir"
-		Value="$(externalsDir)\openssl-1.0.1g"
+		Value="$(externalsDir)\openssl-1.0.1h"
 	/>
 	<UserMacro
 		Name="tcltkDir"
diff --git a/PCbuild/readme.txt b/PCbuild/readme.txt
index b96fef2..9c017df 100644
--- a/PCbuild/readme.txt
+++ b/PCbuild/readme.txt
@@ -132,7 +132,7 @@
 
     Get the source code through
 
-    svn export http://svn.python.org/projects/external/openssl-0.9.8y
+    svn export http://svn.python.org/projects/external/openssl-1.0.1h
 
     ** NOTE: if you use the Tools\buildbot\external(-amd64).bat approach for
     obtaining external sources then you don't need to manually get the source
diff --git a/Tools/buildbot/external-common.bat b/Tools/buildbot/external-common.bat
index 7e44199..8453dcb 100644
--- a/Tools/buildbot/external-common.bat
+++ b/Tools/buildbot/external-common.bat
@@ -21,6 +21,7 @@
 @rem if exist db-4.7.25.0 rd /s/q db-4.7.25.0
 @rem if exist openssl-0.9.8y rd /s/q openssl-0.9.8y
 @rem if exist openssl-1.0.1g rd /s/q openssl-1.0.1g
+@rem if exist openssl-1.0.1h rd /s/q openssl-1.0.1h
 @rem if exist sqlite-3.6.21 rd /s/q sqlite-3.6.21
 
 @rem bzip
@@ -34,8 +35,8 @@
 if not exist db-4.7.25.0 svn export http://svn.python.org/projects/external/db-4.7.25.0
 
 @rem OpenSSL
-if exist openssl-0.9.8y rd /s/q openssl-0.9.8y
-if not exist openssl-1.0.1g svn export http://svn.python.org/projects/external/openssl-1.0.1g
+if exist openssl-1.0.1g rd /s/q openssl-1.0.1g
+if not exist openssl-1.0.1h svn export http://svn.python.org/projects/external/openssl-1.0.1h
 
 @rem tcl/tk
 if not exist tcl-8.5.15.0 (