Correct NEWS entry about required security level for old versions of TLS, DTLS and SSL

The entry was incorrect because suites using RSA key exchange without SHA1
were permitted at security level 1.

Partial fix for #18194

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/18234)

diff --git a/NEWS.md b/NEWS.md
index dcd97d993b5630da8b50c30d056400c6aa3e8cb7..7ced6898cca6cefd95933c6a1d262721c2d34e85 100644 (file)
--- a/NEWS.md
+++ b/NEWS.md
@@ -115,7 +115,8 @@ OpenSSL 3.0
     RC4, RC5 and SEED cipher functions have been deprecated.
   * All of the low-level DH, DSA, ECDH, ECDSA and RSA public key functions
     have been deprecated.
-  * SSL 3, TLS 1.0, TLS 1.1, and DTLS 1.0 only work at security level 0.
+  * SSL 3, TLS 1.0, TLS 1.1, and DTLS 1.0 only work at security level 0,
+    except when RSA key exchange without SHA1 is used.
   * Added providers, a new pluggability concept that will replace the
     ENGINE API and ENGINE implementations.