Hacker News Reader

Comment by bluejekyll | Hacker News Reader

Aren't these the currently maintained versions? Anying pre-1.0.1 is no longer being maintained, and they note 1.0.1 will be going away soon too.

View on HN

Quite right! I missed that bit.

    Note
    ====
    
    Support for version 1.0.1 ended on 31st December 2016. Support for versions
    0.9.8 and 1.0.0 ended on 31st December 2015. Those versions are no longer
    receiving security updates.

The OpenSSL team may not be maintaining them but some distros are.

It's not clear whether the first CVE (crash via OOB read) affects 1.0.1.

Reply on news.ycombinator.com