Comment 13 for bug 1849624

Brian's plan makes sense aside from #7. Instead I recommend we switch the bug to public while seeking volunteers to draft a note about it at https://wiki.openstack.org/wiki/Security_Notes for increased visibility. Keeping it under a private embargo when there's no patch forthcoming serves no purpose that I can see, since the advised workaround is already available and can be found in the discussion here.