Cent OS is based on Red Hat Enterprise Linux and the main goal of a distribution produced for enterprise customers is to provide robust, stable and reliable OS and system software.
Major releases usually contain recent but established versions of current software. Subsequent minor releases will contain packages with minor updates of that software.
However, they won’t have updates of software which has major revisions, i.e., their update packages only contain minor enhancements that shouldn’t cause any compatibility issues.
In your case:
- 6 is the major release
- 6.6 is the minor release
When Red Hat released version 6 of their Enterprise Linux, they chose version 1.0.0 for OpenSSL but over the course of the minor updates to RHEL 6.6, they upgraded to version 1.0.1e. This page details the updates to the Red Hat OpenSSL package for the minor releases of RHEL 6.
While newer versions of the upstream software will contain bug fixes included with the enhanced features, Red Hat backport the fixes and patch bugs in their packages so that their customers can benefit from the latest upstream security fixes while retaining stability and compatibility with their other software packages.
From Backporting Security Fixes
Backporting has a number of advantages for customers, but it can create confusion when it is not understood. Customers need to be aware that just looking at the version number of a package will not tell them if they are vulnerable or not. For example, stories in the press may include phrases such as "upgrade to Apache httpd 2.0.43 to fix the issue," which only takes into account the upstream version number. This can cause confusion as even after installing updated packages from a vendor, it is not likely customers will have the latest upstream version. They will instead have an older upstream version with backported patches applied.
Also, some security scanning and auditing tools make decisions about vulnerabilities based solely on the version number of components they find. This results in false positives as the tools do not take into account backported security fixes.
See also What's the difference between a major, minor, and asynchronous release?.