Comment 10 for bug 1830862

Since this now has a CVE, and as per Kevin's original description, Semmle have a 90-day disclosure timeframe, we need to assign a CRD for this issue - we are now 77 days into this 90 day period - as such I propose the CRD to be at the 90-day deadline which would be 2019-08-27 - unless Semmle are happy to extend it further. Kevin can you confirm if this works for you? Also do you have a preferred time-of-day for the CRD?