Wasn't the Debian bug in OpenSSL? Building OpenSSH yourself would not do you any good there if you linked to the distribution's OpenSSL.