Thankfully the RCE vulnerability is only in OpenSSL 1.1, which is probably not commonly used yet.

Does the second issue imply that OpenSSL does not have any automated tests for the CRL functionality?