update for openssl CVEs

[maxamillion]

#1235

[tianon]

LGTM

Build test of #1316; f2e7b70 (fedora):

$ bashbrew build "fedora"
Cloning fedora (git://github.com/fedora-cloud/docker-brew-fedora) ...
Processing fedora:latest ...
Processing fedora:23 ...
Processing fedora:22 ...
Processing fedora:21 ...
Processing fedora:rawhide ...
Processing fedora:20 ...
Processing fedora:heisenbug ...
$ bashbrew list --uniq "$url" | xargs test/run.sh
testing fedora:latest
    'utc' [1/4]...passed
    'cve-2014--shellshock' [2/4]...passed
    'no-hard-coded-passwords' [3/4]...passed
    'override-cmd' [4/4]...passed
testing fedora:22
    'utc' [1/4]...passed
    'cve-2014--shellshock' [2/4]...passed
    'no-hard-coded-passwords' [3/4]...warning: garbage password detected for 'root': 'locked'
passed
    'override-cmd' [4/4]...passed
testing fedora:21
    'utc' [1/4]...failed; unexpected output:
--- /usr/src/pr/test/tests/utc/expected-std-out.txt
+++ -
@@ -1 +1 @@
-UTC
+EST
    'cve-2014--shellshock' [2/4]...passed
    'no-hard-coded-passwords' [3/4]...warning: garbage password detected for 'root': 'locked'
passed
    'override-cmd' [4/4]...passed
testing fedora:rawhide
    'utc' [1/4]...passed
    'cve-2014--shellshock' [2/4]...passed
    'no-hard-coded-passwords' [3/4]...passed
    'override-cmd' [4/4]...passed
testing fedora:20
    'utc' [1/4]...passed
    'cve-2014--shellshock' [2/4]...passed
    'no-hard-coded-passwords' [3/4]...warning: garbage password detected for 'root': 'locked'
passed
    'override-cmd' [4/4]...passed

There is at least one failure in the above build log.