systemd-tmpfiles in systemd through 237 mishandles symlinks present in
non-terminal path components, which allows local users to obtain ownership
of arbitrary files via vectors involving creation of a directory and a file
under that directory, and later replacing that directory with a symlink.
This occurs even if the fs.protected_symlinks sysctl is turned on.
I believe this bug can be closed; the oldest version of systemd in gentoo is 242.
Why is this bug still open?
Looks like 240 was the last affected version at a quick look.
We already did a GLSA for a newer version, so no need for this older version: bug 708806.