The security flaw is inside a library that has been released under a bsd style license (otherwise, the "goto fail;" hilarity would never have ensued). You're free to download the source of the 10.9 library, patch it, compile it and replace the vulnerable binary with the one you fixed.