EPEL Lighttpd vulnerability still unfixed after 9 months