This is an issue only if the package uses a vulnerable version of log4j. If this is the case, you would need to get a fixed version of the third-party component. If you have the source code, you can compile it yourself with the fixed log4j version.