From a notice sent by the OpenSSL team to internal groups:

"Since these security defects are considered as moderate severity or less no further details or patches will be made available in advance of the release..."

So waiting 2 months for something that is not critical is no reason to start acting like the sky is falling.