Apparently they would just need to build a newer release, the fix is already done (but I suspect that doing so would evoke other compliance issues, which is probably why it wasn't done; obviously this isn't the open source project's problem).