[notherhack]

Looks like Debian and some other distros are still on the vulnerable 3.5.4. Why did Openssl publish before the distros rolled to the fixed version?

[samueloph]

This was patched on time: https://tracker.debian.org/news/1710762/accepted-openssl-354...