Docker scout security check reports an issue with satori/go.uuid

[thbley]

Docker scout reports a security issue in satori/[email protected].
Maybe this library could be replaced with an alternative? (see satori/go.uuid#120)

To reproduce:

wget -qO- https://github.com/axllent/mailpit/releases/latest/download/mailpit-linux-amd64.tar.gz | tar xvz mailpit

docker scout cves fs://mailpit
    ✓ File system read
    ✓ Indexed 51 packages
    ✗ Detected 1 vulnerable package with 1 vulnerability

## Overview

                    │        Analyzed path         
────────────────────┼──────────────────────────────
  Target            │  fs://mailpit                
    vulnerabilities │    1C     0H     0M     0L   

## Packages and Vulnerabilities

   1C     0H     0M     0L  github.com/satori/go.uuid 1.2.0
pkg:golang/github.com/satori/[email protected]

    ✗ CRITICAL CVE-2021-3538
      https://scout.docker.com/v/CVE-2021-3538
      Affected range : <1.2.1-0.20181016170032-d91630c85102  
      Fixed version  : 1.2.1-0.20181016170032-d91630c85102   
    
1 vulnerability found in 1 package
  LOW       0  
  MEDIUM    0  
  HIGH      0  
  CRITICAL  1  

Thanks!

[axllent]

Thanks for raising this issue. I'm surprised by this given that it was reported 2 years ago and still exists. I will look into a suitable replacement .

[axllent]

This will be released in the next few hours 👍