If you have manually installed your own version of OpenSSL instead of the version provided by Ubuntu, then you are responsible for keeping it updated, including installing any security patches.
It is usually safer to use the version provided by Ubuntu as you will then receive security updates through the normal update process.
The two will have different update schedules and processes, but both will aim to patch in a timely manner after a security issue is found. Ubuntu will backport the patch (ie rewrite the patch so it works on an older version) to the stable version in Ubuntu, whereas upstream may make the patch only available by updating to the latest version.
Another thing to be aware of is that many Ubuntu packages depend on an OpenSSL library. You may find that you have both the manually installed version and the Ubuntu-provided version installed due to it being brought in as a dependency.