http://upstream-tracker.org/compat_r..._Risk_Problems

we have CVE-2010-0742 fix included in CSSU, so the version is effectively 0.9.8o

Sure, someone can check if the above change affects maemo, but I'd consider that it breaks the ABI until shown some evidence of the opposite. Which might not be possible if we have closed source binaries using openssl

EDIT:
IMO the sane way is to find all the stuff like https://www.openssl.org/news/secadv_20101116.txt and include those patches in CSSU openssl