The &quot;severity&quot; is often not accurate. OpenSSL recently marked an issue as lowly severe, but in fact its severity was high.<p>Don&#x27;t trust them. OpenSSL is bad, use LibreSSL instead. OpenSSL == NSA. For sure they know weaknesses and actively exploit them if required.<p>EDIT: I&#x27;m talking about this advisory: <a href="https:&#x2F;&#x2F;www.openssl.org&#x2F;news&#x2F;secadv&#x2F;20150108.txt" rel="nofollow">https:&#x2F;&#x2F;www.openssl.org&#x2F;news&#x2F;secadv&#x2F;20150108.txt</a>