Is shipping with zero CVEs a marketing gimmick or was Red Hat knowingly shipping vulnerable software prior to this?