Then again, how long does a fix realistically take for a security-relevant issue? Even if it's low or minor, more than a year is long.