Bump gitian OpenSSL dependency *again* #4135

Looks like there has been another problem found in OpenSSL, CVE-2010-5298, a use-after-free which can be used for DoS.

Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.

https://access.redhat.com/security/cve/CVE-2010-5298

Pretty pointless in the case of bitcoind, as only hosts already in rpcallow could do the attack if you have rpcssl enabled. The GUI could maybe be made to crash by making it access a hostile server.

In any case, for next release we may as well upgrade it...

May be a non-issue.

https://bugzilla.redhat.com/show_bug.cgi?id=1087195#c1

"The bug only affects connections with the SSL_MODE_RELEASE_BUFFERS option set. This isn’t a compile option; it’s a runtime option set by the application."

We don't set that option neither does Qt.

This doesn't affect us, also no new version of OpenSSL has been released yet, so closing.