Coverity flags MD5CryptoServiceProvider in Northwoods.Go.Pdf.GoPdfWriter (GoPdfWriter.dll v5.1.0.4) — fixed version / workaround?

GoDiagram (6 and previous)
1

Hi Northwoods team,

We are using Northwoods.Go.Pdf.GoPdfWriter.dll version 5.1.0.4 for PDF export. Our static security scanning tool (Coverity) is reporting a finding: “Risky cryptographic hashing function / weak hashing algorithm”.

From a quick decompilation review, it appears that MD5CryptoServiceProvider is instantiated/used in certain internal code paths of GoPdfWriter (we suspect it may be related to image handling / image dedup / resource generation during PDF creation).

Since MD5 is considered weak (collision-prone) and flagged by our security policies/tooling, we need guidance on the following:

  1. Is MD5 usage expected in GoPdfWriter.dll v5.1.0.4? If yes, what is it used for (e.g., caching/dedup only vs any integrity/authentication/security decision)?

  2. Which version fixes/removes MD5 usage (e.g., replaced with SHA-256 or another approach)? Please share the recommended upgrade target version.

  3. Is there a configuration/setting/workaround to avoid the MD5 code path (for example, related to image export features) without a major refactor?

  4. If MD5 is only used for non-security purposes, do you have an official statement/recommendation we can reference for our internal security review?

Can you please review it.

Thanks,

Yug

2

Hello,

  1. Yes MD5 is used in GoPdfWriter for computing a hash ID for the PDF trailer and for de-duplicating images.
  2. As of .NET 6 (GoDiagram v6.3) we are using System.Security.Cryptography.MD5 rather than System.Security.Cryptography.MD5CryptoServiceProvider, but I don’t know if that helps.
  3. No, the call to MD5’s ComputeHash in on the main code path.
  4. We don’t have an official statement here, but the code is used solely for generating a unique ID for the PDF and for ensuring duplicate images are loaded just once. There’s no security use at all.