This is already mentioned in a different comment here[1], but for ease of reference, Arch Linux did ship a vulnerable version and released the fix on 2 February

This is already mentioned in a different comment here[1], but for ease of reference, Arch Linux did ship a vulnerable version and released the fix on 2 February[2]. [1] https://news.ycombinator.com/item?id=34713862 https://news.ycombinator.com/item?id=34713862 [2] https://github.com/archlinux/svntogit-packages/commit/79687856fe542fcbe722751d1314f105ede34863 https://github.com/archlinux/svntogit-packages/commit/796878...