The two options are open. ERRATAs are usually when the information provided in an advisory is incorrect, and should therefore be redacted. New advisories are for when a subsequent issue is found.
Incomplete fixes fall in the middle. In this specific case, it feels like the original OSSA is still correct, but a regression / corner case was discovered in the fix. I think it's simpler to just issue a new one in that specific case (referencing the old one).
The two options are open. ERRATAs are usually when the information provided in an advisory is incorrect, and should therefore be redacted. New advisories are for when a subsequent issue is found.
Incomplete fixes fall in the middle. In this specific case, it feels like the original OSSA is still correct, but a regression / corner case was discovered in the fix. I think it's simpler to just issue a new one in that specific case (referencing the old one).