We had intended to update this via a DSA in stable and oldstable, but I believe <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1036857> renders this unexploitable, so it'll probably go in as a point release instead.
Dominic
- Bug#1067571: anope: suspended users can reset their pas... Dominic Hargreaves
- Bug#1067571: applicability to stable and oldstable Dominic Hargreaves
