title: OWASP step fails due to itextpdf-5.5.12 dependency (CVE-2021-43113)
body: <p>In our project pom.xml we use flying-saucer-pdf-itext5 version 9.1.22, which has a dependency on itextpdf version 5.5.12. Our pipeline fails due to OWASP step complaining about itextpdf related to this security issue:
  <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-43113" rel="nofollow noreferrer">https://nvd.nist.gov/vuln/detail/CVE-2021-43113</a></p>
  <p>however this issue mentions that</p>
  <blockquote>
  <p>iTextPDF in iText before 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.</p>
  </blockquote>
  <p>which I guess is related to this dependency: itext7-core</p>
  <p>We don't use this dependency directly and I also can't find it in dependencies of itextpdf.</p>
  <p>I excluded the itextpdf 5.5.12 from flying-saucer-pdf-itext5 and added the newest version 5.5.13.2 but the issue still exists.</p>
  <p>Any idea where I should look for this dependency and how to resolve this security issue?</p>