CVE-2019-14973.patch is a manually backported of the upstream patch to work around some minor merge conflicts.