openSUSE Leap 42.1 2016:0720-1 Critical OpenSSL Security Update

This update for compat-openssl098 fixes various security issues and bugs:

Security issues fixed:

- CVE-2016-0800 aka the "DROWN" attack (bsc#968046): OpenSSL was

vulnerable to a cross-protocol attack that could lead to decryption of

TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites

as a Bleichenbacher RSA padding oracle.

This update changes the openssl library to:

* Disable SSLv2 protocol support by default.

This can be overridden by setting the environment variable

"OPENSSL_ALLOW_SSL2" or by using SSL_CTX_clear_options using the

SSL_OP_NO_SSLv2 flag.

Note that various services and clients had already disabled SSL

protocol 2 by default previously.

* Disable all weak EXPORT ciphers by default. These can be reenabled if

required by old legacy software using the environment variable

"OPENSSL_ALLOW_EXPORT".

- CVE-2016-0797 (bnc#968048): The BN_hex2bn() and BN_dec2bn() functions

...