Just looked at both the packages source, and it looks like they are affected. At least all the vulnerable code is in the source package.