OpenSSL is not up-to-date in Ubuntu 13.10

Thanks for taking the time to report this bug and helping to make Ubuntu better. This is not a bug, but rather expected behavior:
https://wiki.ubuntu.com/SecurityTeam/FAQ#Versions

Please feel free to report any other bugs you may find.

You cannot say that you've not been warned.
It's up to you to stick with the old OpenSSL release.
I'm going to build the last 1.0.1g on my system from the sources.

What exactly are you warning us about?

Security fixes are backported to the stable openssl versions that are in each release.

For example, heartbleed (CVE-2014-0160) was fixed in 1.0.1e-3ubuntu1.2 released April 7th with the following USN:

http://www.ubuntu.com/usn/usn-2165-1/

Someone has updated openssl with sources dated 11th of feb, weeks before the Heartbleed issue was made public.
The last official sources were updated on the 7th of April (not the built date, the sources date).

Try:

openssl version -b

What's the result?

Now that I've compiled the latest OpenSSL sources available here (1.0.1g): http://www.openssl.org/source/

I can check the OpenSSL version with "openssl version -a" (not -b; with this you only get the built date, not the version which really matters): https://docs.google.com/document/d/1...it?usp=sharing

-a is only the date at which the original version came out, that isn't the date that matters for Ubuntu since, like most distros, we backport security fixes.

-b will show you when the package was built, and that is what is important.

You probably shouldn't attempt to maintain your own openssl, it will be much easier to stay up-to-date with security fixes if you use the one packaged.