diff --git a/Misc/NEWS b/Misc/NEWS
index 912bf3d..acc76b4 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -92,6 +92,12 @@
 - Issue #21522: Added Tkinter tests for Listbox.itemconfigure(),
   PanedWindow.paneconfigure(), and Menu.entryconfigure().
 
+Windows
+-------
+
+- Issue #21671, CVE-2014-0224: The bundled version of OpenSSL has been
+  updated to 1.0.1h.
+
 
 What's New in Python 3.4.1?
 ===========================
diff --git a/PCbuild/pyproject.props b/PCbuild/pyproject.props
index 2219c95..4bc68fb 100644
--- a/PCbuild/pyproject.props
+++ b/PCbuild/pyproject.props
@@ -20,7 +20,7 @@
     <sqlite3Dir>$(externalsDir)\sqlite-3.8.3.1</sqlite3Dir>
     <bz2Dir>$(externalsDir)\bzip2-1.0.6</bz2Dir>
     <lzmaDir>$(externalsDir)\xz-5.0.5</lzmaDir>
-    <opensslDir>$(externalsDir)\openssl-1.0.1g</opensslDir>
+    <opensslDir>$(externalsDir)\openssl-1.0.1h</opensslDir>
     <tcltkDir>$(externalsDir)\tcltk</tcltkDir>
     <tcltk64Dir>$(externalsDir)\tcltk64</tcltk64Dir>
     <tcltkLib>$(tcltkDir)\lib\tcl86t.lib;$(tcltkDir)\lib\tk86t.lib</tcltkLib>
diff --git a/PCbuild/readme.txt b/PCbuild/readme.txt
index b8184bf..e477d7d 100644
--- a/PCbuild/readme.txt
+++ b/PCbuild/readme.txt
@@ -168,7 +168,7 @@
     Homepage:
         http://tukaani.org/xz/
 _ssl
-    Python wrapper for version 1.0.1g of the OpenSSL secure sockets
+    Python wrapper for version 1.0.1h of the OpenSSL secure sockets
     library, which is built by ssl.vcxproj
     Homepage:
         http://www.openssl.org/
diff --git a/Tools/buildbot/external-common.bat b/Tools/buildbot/external-common.bat
index 76fe7d2..ebee25a 100644
--- a/Tools/buildbot/external-common.bat
+++ b/Tools/buildbot/external-common.bat
@@ -10,7 +10,7 @@
 @rem if exist tcl-8.6.1.0 rd /s/q tcl-8.6.1.0
 @rem if exist tk-8.6.1.0 rd /s/q tk-8.6.1.0
 @rem if exist db-4.4.20 rd /s/q db-4.4.20
-@rem if exist openssl-1.0.1e rd /s/q openssl-1.0.1g
+@rem if exist openssl-1.0.1h rd /s/q openssl-1.0.1h
 @rem if exist sqlite-3.7.12 rd /s/q sqlite-3.7.12    
 
 @rem bzip
@@ -20,9 +20,9 @@
 )
 
 @rem OpenSSL
-if not exist openssl-1.0.1g (
-    rd /s/q openssl-1.0.1e
-    svn export http://svn.python.org/projects/external/openssl-1.0.1g
+if not exist openssl-1.0.1h (
+    rd /s/q openssl-1.0.1g
+    svn export http://svn.python.org/projects/external/openssl-1.0.1h
 )
 
 @rem tcl/tk