Yeah roger that. I realise they aren't the same, but openssh uses code from openssl (says so right in the version string). Gotta wonder if there aren't similar issues there. I'm sure folks are looking the potential to subvert ssh as well now. Paranoia with crypto software is a good thing. I'd prefer my ssh to be compiled against the 'g' code fix just to be sure.
OpenSSH generates private keys for a hash and discards them, if I’m not mistaken. The problem with this vulnerability is that private keys can be compromised, thus making encryption worthless.