Talend isn't patching their open source releases of their software, they are still available for download with no warning they are vulnerable, and no mitigation instructions. They have patches and instructions that work only for their paid offerings though.
In case anyone else may care...