The very bottom of that report says the vulnerability was fixed last September, which seems like burying the lede