In theory someone could be relying on the bug, and not be vulnerable - e.g. if they don't allow any external access to the system. If you just re-publish the o

In theory someone could be relying on the bug, and not be vulnerable - e.g. if they don't allow any external access to the system. If you just re-publish the old version, it's difficult to know whether you've taken the change. If you are going to reissue the same version number - why bother having version numbers at all?