Looks like another case of a vulnerability which was handled poorly by upstream: Bad/insufficient communication and multiple embargo violations.

Ultimately this means there is no fix available yet and no ETA when there will be one.