bugbot adjusting priority

The problem appeared in openssl after the state machine rewrite, so >= 1.1.0.
None of our distributions are affected.

commit df6b5e29ffea2d5a3e08de92fb765fdb21c7a21e
Author: Matt Caswell <matt@openssl.org>
Date:   Mon Sep 19 11:57:07 2016 +0100

    Excessive allocation of memory in dtls1_preprocess_fragment()
    
    This issue is very similar to CVE-2016-6307 described in the previous
    commit. The underlying defect is different but the security analysis and
    impacts are the same except that it impacts DTLS.
    
    A DTLS message includes 3 bytes for its length in the header for the
    message.
    This would allow for messages up to 16Mb in length. Messages of this length
    are excessive and OpenSSL includes a check to ensure that a peer is sending
    reasonably sized messages in order to avoid too much memory being consumed
    to service a connection. A flaw in the logic of version 1.1.0 means that
    memory for the message is allocated too early, prior to the excessive
    message length check. Due to way memory is allocated in OpenSSL this could
    mean an attacker could force up to 21Mb to be allocated to service a
    connection. This could lead to a Denial of Service through memory
    exhaustion. However, the excessive message length check still takes place,
    and this would cause the connection to immediately fail. Assuming that the
    application calls SSL_free() on the failed conneciton in a timely manner
    then the 21Mb of allocated memory will then be immediately freed again.
    Therefore the excessive memory allocation will be transitory in nature.
    This then means that there is only a security impact if:
    
    1) The application does not call SSL_free() in a timely manner in the
    event that the connection fails
    or
    2) The application is working in a constrained environment where there
    is very little free memory
    or
    3) The attacker initiates multiple connection attempts such that there
    are multiple connections in a state where memory has been allocated for
    the connection; SSL_free() has not yet been called; and there is
    insufficient memory to service the multiple requests.
    
    Except in the instance of (1) above any Denial Of Service is likely to
    be transitory because as soon as the connection fails the memory is
    subsequently freed again in the SSL_free() call. However there is an
    increased risk during this period of application crashes due to the lack
    of memory - which would then mean a more serious Denial of Service.
    
    This issue does not affect TLS users.
    
    Issue was reported by Shi Lei (Gear Team, Qihoo 360 Inc.).
    
    CVE-2016-6308
    
    Reviewed-by: Richard Levitte <levitte@openssl.org>
    (cherry picked from commit 48c054fec3506417b2598837b8062aae7114c200)

the issue is only in 1.1.0 , which we are not yet shipping