CVE-2020-19909 is everything that is wrong with CVEs::undefined