A follow up question, would the council be amenable to doing an "emergency bugfix" release just for this CVE? I'm thinking along the lines of what was questioned before, cherry-pick the fix on top of 4.1.2 and cutting a 4.1.3, not worrying about signing or anything, but building packages that folks who would like to, at least have a package fix they can use