The second fix was reportedly necessary after SaltStack did not participate in coordinated disclosure.