- up to 2.0.22, fixes CVE-2013-4402