openblas is still affected by the same CVE. Fix is available with the 0.3.18 release, because of regressions with it at least 0.3.19 should be used