From the recent Debian security advisory (DSA-3500-1) about this: "Additionally the EXPORT and LOW ciphers were disabled since thay could be used as part of th

From the recent Debian security advisory (DSA-3500-1) about this: "Additionally the EXPORT and LOW ciphers were disabled since thay could be used as part of the DROWN (CVE-2016-0800) and SLOTH (CVE-2015-7575) attacks, but note that the oldstable (wheezye)[sic!] and stable (jessie) distributions are not affected by those attacks since the SSLv2 protocol has already been dropped in the openssl package version 1.0.0c-2." So it seems that neither Jessie nor Wheezy are affected by this.