Comment 21 for bug 1549483

Stuart, I meant that we first need to approve the OSSN before moving on (in order to coordinate the disclosure with the security note publication).

Well if the first paragraph of the recommended action doesn't work, indeed it needs to be fixed first.