Please do only add [sarge] specific <not-affected> information if you
have verified it in the actual source code. It's not enough to trust
information from vulnerability data bases, mailing list posts or
upstream, all of which have provided incorrect information in the past.
Cheers,
Moritz