A DROWN attack is an encryption-breaking technique. When the attack was discovered, they found that more than 33% of HTTPS servers were vulnerable. Servers that still support SSLv2 are vulnerable to this attack. In a DROWN attack, the attacker sends probes with the same private key to decrypt the TLS communications. Thus, all the information will be exposed. Not only servers that support SSLv2 are vulnerable, but also an attacker can use a private key from another server that supports SSLv2 to launch the attack.
To test whether your servers are vulnerable to a DROWN attack, you can use https://pentest-tools.com/network-vulnerability-scanning/drown-ssl-scanner:
To defend against a DROWN attack, it is recommended ...
