There is no new release yet (see mailing list post on oss-security), so
I'm picking the commit that fixes the CVE.
There is another security flaw (without a CVE number) that is also
mentioned in the oss-security announcement but it is not explained which
commit patches the problem.
