compensating controls

CVE disclosed and patch announced, but does it actually cover your software version? Sysadmins consistently overlook the affected-versions field in advisories. Here is what to do when no patch is available for your systems.