Add source package association for CVE-2019-13504/exiv2

Not removing the TODO item, as the issue still needs to be looked closer
at. Mark it furthermore as well as <undetermined> as no basic triage has
been done yet.