From this thread, it sounds like the second vulnerability doesn't affect spigot or vanilla minecraft:

https://www.spigotmc.org/threads/spigot-security-releases-%E...

Also, mojang's update instructions:

https://www.minecraft.net/en-us/article/important-message--s...