JMinnihan580744 (Community Member) asked a question.
In one of our .NET C# backends we use a product named QuestPDF. inside there they use libjpeg.-turbo, however, Veracode thinks they are using a version of libjpeg.so.8 with a vulnerability. How do I mitigate this as a false positive?
From QuestPDF Issue https://github.com/QuestPDF/QuestPDF/issues/1212
As previously mentioned, QuestPDF does not use the libjpeg library, but rather libjpeg-turbo, which is a completely different project and implementation.
libjpeg-turbo can be compiled in a compatibility mode that conforms to the libjpeg v8 API/ABI. As a result, the shared library is named libjpeg.so.8, which may lead to some confusion.
Given this context, I believe QuestPDF is not affected by the aforementioned security vulnerabilities.
Could you please advise on any further steps I should take? I would appreciate your suggestions.
.png){kind=logo}
Hi @JMinnihan580744 (Community Member) - We will need some more information to diagnose via support case, it would be helpful to know which scan you're referring to. Please contact us here: https://community.veracode.com/s/contact-support