The versions impacted should be listed as all. Also, the way to fix it is to support use of :1.2.840.113556.1.4.1941: in the group query.  It is only supported by Active Directory domain controllers, but there seem to be plenty of those out there. I ...