We don't have exactly covered situations, when there are CVE fixes for Migration tool (jcr to git) in patch releases. I can think of two possibilities:

• Be able to patch the Migration tool zip with Patch tool
• Release Migration tool zip when needed. (Currently only x.x.0 GA versions, not patches)

psiroky_jira rhn-support-alazarot, please provide feedback for this.