openSUSE 13.1: 2016:0638-1 Important: openssl DROWN DoS Attack

This update for openssl fixes various security issues:

Security issues fixed:

- CVE-2016-0800 aka the "DROWN" attack (bsc#968046): OpenSSL was

vulnerable to a cross-protocol attack that could lead to decryption of

TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites

as a Bleichenbacher RSA padding oracle.

This update changes the openssl library to:

* Disable SSLv2 protocol support by default.

This can be overridden by setting the environment variable

"OPENSSL_ALLOW_SSL2" or by using SSL_CTX_clear_options using the

SSL_OP_NO_SSLv2 flag.

Note that various services and clients had already disabled SSL

protocol 2 by default previously.

* Disable all weak EXPORT ciphers by default. These can be reenabled if

required by old legacy software using the environment variable

"OPENSSL_ALLOW_EXPORT".

- CVE-2016-0702 aka the "CacheBleed" attack. (bsc#968050) Various changes

in the...