Potential secutiry vulnerability in the shared library which cf4j depends on. Can you help upgrade to patch versions?

[HelenParr]

Hi, @ferortega , @jesusmayor , I'd like to report a vulnerability issue in es.upm.etsisi:cf4j:2.2.7.

Issue Description

es.upm.etsisi:cf4j:2.2.7 directly or transitively depends on 639 C libraries (.so) cross many platforms(such as x86-64, x86, arm64, armhf). However, I noticed that some C libraries are vulnerable, containing the following CVEs:

liblept.so from C project libjpeg-turbo(version:1.5.3) exposed 1 vulnerabilities: CVE-2018-14498

Suggested Vulnerability Patch Versions

libjpeg-turbo has fixed the vulnerabilities in versions >=2.1.0

Java build tools cannot report vulnerable C libraries, which may induce potential security issues to many downstream Java projects. Could you please upgrade the above shared libraries to their patch versions?

Thanks for your help~ Best regards, Helen Parr