diff --git a/Misc/NEWS b/Misc/NEWS
index 8e5fb3ad750..caf6c1819f5 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -484,8 +484,6 @@ Build
 
 - Issue #21037: Add a build option to enable AddressSanitizer support.
 
-- The Windows build now includes OpenSSL 1.0.1g
-
 - Issue #19962: The Windows build process now creates "python.bat" in the
   root of the source tree, which passes all arguments through to the most
   recently built interpreter.
@@ -607,6 +605,12 @@ Tools/Demos
 - Issue #20535: PYTHONWARNING no longer affects the run_tests.py script.
   Patch by Arfrever Frehtes Taifersar Arahesis.
 
+Windows
+-------
+
+- Issue #21671, CVE-2014-0224: The bundled version of OpenSSL has been
+  updated to 1.0.1h.
+
 
 What's New in Python 3.4.0?
 ===========================
diff --git a/PCbuild/pyproject.props b/PCbuild/pyproject.props
index d9811cc6d9a..20b63fcb708 100644
--- a/PCbuild/pyproject.props
+++ b/PCbuild/pyproject.props
@@ -20,7 +20,7 @@
     <sqlite3Dir>$(externalsDir)\sqlite-3.8.3.1</sqlite3Dir>
     <bz2Dir>$(externalsDir)\bzip2-1.0.6</bz2Dir>
     <lzmaDir>$(externalsDir)\xz-5.0.5</lzmaDir>
-    <opensslDir>$(externalsDir)\openssl-1.0.1g</opensslDir>
+    <opensslDir>$(externalsDir)\openssl-1.0.1h</opensslDir>
     <tclDir>$(externalsDir)\tcl-8.6.1.0</tclDir>
     <tkDir>$(externalsDir)\tk-8.6.1.0</tkDir>
     <tixDir>$(externalsDir)\tix-8.4.3.4</tixDir>
diff --git a/PCbuild/readme.txt b/PCbuild/readme.txt
index 5d6c0ebaf33..5a163774af5 100644
--- a/PCbuild/readme.txt
+++ b/PCbuild/readme.txt
@@ -168,7 +168,7 @@ _lzma
     Homepage:
         http://tukaani.org/xz/
 _ssl
-    Python wrapper for version 1.0.1g of the OpenSSL secure sockets
+    Python wrapper for version 1.0.1h of the OpenSSL secure sockets
     library, which is built by ssl.vcxproj
     Homepage:
         http://www.openssl.org/
diff --git a/Tools/buildbot/external-common.bat b/Tools/buildbot/external-common.bat
index 8e62cf7fedb..acc2b020567 100644
--- a/Tools/buildbot/external-common.bat
+++ b/Tools/buildbot/external-common.bat
@@ -10,7 +10,7 @@ cd ..
 @rem if exist tcl-8.6.1.0 rd /s/q tcl-8.6.1.0
 @rem if exist tk-8.6.1.0 rd /s/q tk-8.6.1.0
 @rem if exist db-4.4.20 rd /s/q db-4.4.20
-@rem if exist openssl-1.0.1e rd /s/q openssl-1.0.1g
+@rem if exist openssl-1.0.1h rd /s/q openssl-1.0.1h
 @rem if exist sqlite-3.7.12 rd /s/q sqlite-3.7.12
 
 @rem bzip
@@ -20,9 +20,9 @@ if not exist bzip2-1.0.6 (
 )
 
 @rem OpenSSL
-if not exist openssl-1.0.1g (
-    rd /s/q openssl-1.0.1e
-    svn export http://svn.python.org/projects/external/openssl-1.0.1g
+if not exist openssl-1.0.1h (
+    rd /s/q openssl-1.0.1g
+    svn export http://svn.python.org/projects/external/openssl-1.0.1h
 )
 
 @rem tcl/tk/tix