No matter who discovered it, there was a patch in late February. One can excuse them for describing the commit as something ordinary to avoid alerting the baddies (traditional "disclosure window" etc. stuff) but it's absurd to me that the corresponding releases, with no other code changes (per the commit history), took almost 8 months.