Reading the tea leaves on this one early we can probably assume there's a good chance the high vulnerability does not affect libressl, which forked before the 1.0.2 codebase. We'll find out about the low.
So rhe Openssl devs are the new carpenters? They should specify an exact time instead, so that I can upgrade at a known time without having block the entire afternoon. They could just as well tell us it would be available at 5pm.