This was patched on time: https://tracker.debian.org/news/1710762/accepted-openssl-354...