From the article... Ruprich's reply was something of a surprise. "Thanks for the contribution. At this time we don't plan to address this in RHEL but we will ke

From the article... Ruprich's reply was something of a surprise. "Thanks for the contribution. At this time we don't plan to address this in RHEL but we will keep it open for evaluation based on customer feedback," he wrote. Wright then asked: "Is customer demand really necessary to fix CVEs? I kind of understand (the fix) if you don't want to rebase to a newer version but I genuinely do not understand rejecting this one." To which Ruprich shot back: "We commit to addressing Red Hat defined Critical and Important security issues. Security vulnerabilities with Low or Moderate severity will be addressed on demand when customer or other business requirements exist to do so." Wright was clearly puzzled by this attitude, asking: "I can even understand that, but why reject the fix when the work is already done and just has to be merged?"