Comment 4 for bug 1638596

Looks like a class B3 to me: https://security.openstack.org/vmt-process.html#incident-report-taxonomy, which doesn't require an advisory. Also, since it's already public, no need to keep it private here.

Confirmed this with fungi.