It's about using a certified cryptography implementation. Presumably RHEL has such a certification, while Debian has a compliant but uncertified implementation.

This isn't relevant to the CVE, but counters the claim that Debian is always a suitable choice of distribution.