This question already has an answer here:
Recently, to deal with newly revealed SSL bugs I upgraded my pure Debian distribution. OpenSSL reports a version number of 1.0.1e which is not the latest, however, I am told that it is ok, because the reported build time produced by:
openssl version -b
is June 4, 2014. So, even though the "version" is older, I am assured that Debian somehow "patched" the vulnerabilities, so I don't actually need 1.0.1h as security posts claim, because my 1.0.1e is patched.
I guess I don't understand this. Can anybody explain what the heck is going on? How am I supposed to know that the vulnerabilities are patched if it says 1.0.1e, not 1.0.1h as it should? Why doesn't Debian just freaking put 1.0.1h in the distribution? I do not get this.