Please see RUSTSEC-2018-0020

This vulnerability was misfiled under the wrong year and has been withdrawn...