Thank you so much Utkarsh for the patch,
Please, upload it to unstable, as I have to upload it by Debian Mentors so it will reach testing faster if you upload it to fix this security bug. Also, you can upload it to buster-pu, the package version is the same than in Stretch, so it just to upload the same that you have already upload for Stretch. I will send the patch to upstream. There are several minor issues I have to coordinate with upstream that can be done later. Thank you so much for your great work. Jose