Once you have JTAC identify the specific PR you will be able to determine which versions have the patched code. The timelines work like this as an example:
Issue discovered 2013 and introduced 2 years before that 2011
Affected versions will be high 11 through 13 at specific revision numbers
Patched version will be ported into these chains at a higher revision number
So there are versions of 11, 12 & 13 with and without the issue
The PR will list both the affected version and below and the patched version and above for that specific bug.