Minor nit: this post mentions v2.7.1 as safe from these vulnerabilities, but it is not. v2.7.4 is the first safe version (this mistake was inherited from the bogus oss-security post that is linked in the article).