RH 9's openssl??

[Rhugga]

This may be a stupid question but I have not been keeping up on 
things... I know there have been numerous vulnerabilities discovered in 
openssl-0.9.7x and it seems RH 9, even the latest update, is still 
openssl-0.9.7a...

I notice the minor version has changed (I think openssl-0.9.7a-20 is the 
latest update) but not the core version. Is there a reason Red Hat is 
lagging on this?

Is everyone rolling there own builds of openssl?

Thx,
keg