Comment 7 for bug 1787752

Thanks for reporting this - since this does not affect Debian stable (only bionic and any distros based on bionic) there doesn't seem to be much need for wider disclosure of this issue at this stage (especially given that mirror:// is a non-standard, opt-in configuration and so not widely deployed by default and so the impact of this bug is not widespread)