List of changes:
https://github.com/openssl/openssl/blob/OpenSSL_1_0_1-stable/CHANGES

Skimming through them the one most likely to affect end users is:

*) Reject DH handshakes with parameters shorter than 768 bits.
[Kurt Roeckx and Emilia Kasper]

There are also some related changes we may want to make at the same time:

From io.js:

nodejs/node#1739

• Is this still needed given the openssl update, possibly as it could provide better error info.

nodejs/node#1831

• Do we still need this one given the limitation in the new version of open ssl
• patch likely applies ok to 0.12.X but 0.10.X would require refactoring

Joyent/node issue

Drop at DH group modp1 from as suggsted in -#25366

Some related docs:

• http://www.internet-computer-security.com/VPN-Guide/Diffie-Hellman.html
• https://weakdh.org/imperfect-forward-secrecy.pdf (From 25366)