On Fri, 20 Oct 2017, Florian Weimer wrote: > I plan to commit this once we have the CVE ID from MITRE. Commits should not need to wait for CVEs; the NEWS entry for a security fix can be updated with the CVE later once available. -- Joseph S. Myers joseph@codesourcery.com