If there's consensus from the Horizon maintainers on a fix which is safely backportable to stable branches, and that the risk of exploitation for this defect is sufficiently severe to warrant broad distribution of a security advisory, then I can file a request with MITRE to have a CVE assigned for inclusion in that advisory.
If there's consensus from the Horizon maintainers on a fix which is safely backportable to stable branches, and that the risk of exploitation for this defect is sufficiently severe to warrant broad distribution of a security advisory, then I can file a request with MITRE to have a CVE assigned for inclusion in that advisory.