There are 2 copies of the notifier middleware in different places in Oslo.
The copy in the incubator is used by projects that have not yet updated to oslo.messaging, such as neutron.
There is also a copy in the PyCADF library, used by projects that have updated to oslo.messaging, such as ceilometer.
Based on the history here, it looks like both copies have been fixed, so I think changing the impact description to say "the PyCADF library" instead of "the Oslo Library" will make it clear which library needs to be updated.
There are 2 copies of the notifier middleware in different places in Oslo.
The copy in the incubator is used by projects that have not yet updated to oslo.messaging, such as neutron.
There is also a copy in the PyCADF library, used by projects that have updated to oslo.messaging, such as ceilometer.
Based on the history here, it looks like both copies have been fixed, so I think changing the impact description to say "the PyCADF library" instead of "the Oslo Library" will make it clear which library needs to be updated.