God damn it not again. Bring on boringssl/libressl. Although they'll be full of holes as well probably, and as things stand there's a lot of people looking at openssl at the moment. So maybe better the devil you know
The LibReSSL folks removed the whole SRP module from their tree recently[0] because an embargo that prevented them from releasing just a bugfix in what they thought was a reasonable timeframe. I'm guessing that was for either CVE-2014-5139 or CVE-2014-3512.
That does actually give me some confidence that some of the other non-OpenSSL dev teams might do measurably better.