I&#x27;m not hrtghrth3, so can&#x27;t speak for him... but..<p>Yes, I have a problem with that. I trust I can count on Debian&#x2F;Ubuntu&#x2F;RHEL will ship a new package for every critical CVE promptly, without forcing me to upgrade to the latest upstream version. I have zero faith upstream maintainers will do the same - which leaves me with two choices<p>1) Pretend there is no CVE<p>2) Use the latest app version, bringing with it all new bugs, workarounds, incompatibilities and so forth - and hey, the latest version might not even have the fixed code in it.