cve-log: one 'stable' fix can point to several upstream commit

See 143d9963df6580491f9a5c38c9d4883786f78123