I once fixed a CVE by removing a line. And, IIRC, my only contribution to openssl is a single-character one.