log4j in old launcher.jar

So does the old launcher.jar patch propely for the log4j security problem?

I still have .minecraft/libraries/org/apache/logging/log4j/log4j-core/2.14.1...

In 1.18.1.json it still points to 2.14.1 but according to all sites on the internet you need 2.15 to be safe?!