Move CVE-2019-5051 listing

Both work, but given it was just released "yesterday" in the DLA, let's
build the fixed status from the DLA listing and include the CVE in the
DLA itself.