What to do about CVE numbers
What to do about CVE numbers
Posted Oct 10, 2019 8:52 UTC (Thu) by geert (subscriber, #98403)In reply to: What to do about CVE numbers by NYKevin
Parent article: What to do about CVE numbers
Hence you use the commit hash of the _fix_ to refer to the bug.
The commit description of the fix can/should still have two or three Fixes tags.
And of course the description should clearly explain what's the underlying issue.