Backporting security/critical bug fixes

[Florian Weimer]

Should we put patches which have been backported upstream in all active
Fedora releases (unless they affect non-Fedora releases or are clearly
minor)?

Florian