SUSE: 2016:0678-1 Important: OpenSSL DROWN Issue Mitigation

OpenSSL was update to fix security issues and bugs: * CVE-2016-0800 aka the "DROWN" attack (bsc#968046): OpenSSL was vulnerable to a cross-protocol attack that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. This update changes the OpenSSL library to: o Disable SSLv2 protocol support by default. This can be overridden by setting the environment variable "OPENSSL_ALLOW_SSL2" or by using SSL_CTX_clear_options using the SSL_OP_NO_SSLv2 flag. Note that various services and clients had already disabled SSL protocol 2 by default previously. o Disable all weak EXPORT ciphers by default. These can be re-enabled if required by old legacy software using the environment variable "OPENSSL_ALLOW_EXPORT". *