Are these false positives?

[murpg]

Analysing lib\lucee-5.3.9.80-SNAPSHOT.jar
CVE-2021-44228 found in class file D:\ColdFusion2021\cbhome\lib\lucee-5.3.9.80-SNAPSHOT\bundles\org.lucee.log4j-core-2.17.1\org\apache\logging\log4j\core\util\NetUtils.class

Analysing lib\runwar-4.7.1-SNAPSHOT.jar
CVE-2021-44228 found in class file D:\ColdFusion2021\cbhome\lib\runwar-4.7.1-SNAPSHOT\org\apache\logging\log4j\core\util\NetUtils.class

Analysing engine\cfml\cli\lucee-server\bundles\org.lucee.log4j-core-2.17.1.jar
CVE-2021-44228 found in class file D:\ColdFusion2021\cbhome\engine\cfml\cli\lucee-server\bundles\org.lucee.log4j-core-2.17.1\org\apache\logging\log4j\core\util\NetUtils.class

[anddann]

Thanks for pointing out he issue, looks like an instance of #8
What do you think @johspaeth
We'll check it.

[bdw429s]

This can be closed as a duplicate of #16 The OP is working with me and didn't realize I already had entered a ticket.