https://build.opensuse.org/request/show/1064243 was accepted to Factory, this contains the CVE and bugzilla references.