I understand not disclosing the vulnerability itself, but if they won't even disclose the affected library's name then they are being grossly irresponsible or a

I understand not disclosing the vulnerability itself, but if they won't even disclose the affected library's name then they are being grossly irresponsible or are under an NSL. If they are under an NSL and not just being irresponsible that would mean the vulnerability is part of one of the stolen NSA exploit kits. If I use the library, and it is non-essential for my business, then I should know what it is so that I can remove it.