In June 2019, I got an email from Mike Salvatore who reported having a problem with the library, generating a DoS. I don't really support 0.1.x... but Mike was kind enough to create a patch. I applied it and created a new version of the source tarball for download and posted everywhere about the issue and the availability of the patched version 0.1.7.
What are you expected to do with the older versions that have that one bug in them?
I can't add a note directly in the old versions since the tarballs, the CVS, all of those things are expected to all be frozen (read-only.)
So I posted notes about the corresponding CVE-2019-13543 on all the attached websites.
Would you do more? Sourceforge.net lets me delete the old .tar.gz files, for example. I can also rename the folders (so instead of
0.1.5, I could have
0.1.5-with-DoS or something of the sort.) The one place where I've seen people dealing with such issues is Drupal and they hide versions that have security issues, but they remain available for download. You have to know your way to those files, though, they are somewhat hidden. So it seems to me that just leaving everything else the way it is would be the normal solution for such. Is that correct?