[GH-ISSUE #189] Docker scout security check reports an issue with satori/go.uuid #124

New issue

Closed

opened 2026-03-15 12:44:53 +03:00 by kerem · 2 comments

kerem commented

2026-03-15 12:44:53 +03:00

Owner

Originally created by @thomas-0816 on GitHub (Oct 15, 2023).
Original GitHub issue: https://github.com/axllent/mailpit/issues/189

Docker scout reports a security issue in satori/go.uuid@1.2.0.
Maybe this library could be replaced with an alternative? (see https://github.com/satori/go.uuid/issues/120)

To reproduce:

wget -qO- https://github.com/axllent/mailpit/releases/latest/download/mailpit-linux-amd64.tar.gz | tar xvz mailpit

docker scout cves fs://mailpit
    ✓ File system read
    ✓ Indexed 51 packages
    ✗ Detected 1 vulnerable package with 1 vulnerability

## Overview

                    │        Analyzed path         
────────────────────┼──────────────────────────────
  Target            │  fs://mailpit                
    vulnerabilities │    1C     0H     0M     0L   

## Packages and Vulnerabilities

   1C     0H     0M     0L  github.com/satori/go.uuid 1.2.0
pkg:golang/github.com/satori/go.uuid@1.2.0

    ✗ CRITICAL CVE-2021-3538
      https://scout.docker.com/v/CVE-2021-3538
      Affected range : <1.2.1-0.20181016170032-d91630c85102  
      Fixed version  : 1.2.1-0.20181016170032-d91630c85102   
    
1 vulnerability found in 1 package
  LOW       0  
  MEDIUM    0  
  HIGH      0  
  CRITICAL  1

Thanks!

Originally created by @thomas-0816 on GitHub (Oct 15, 2023). Original GitHub issue: https://github.com/axllent/mailpit/issues/189 Docker scout reports a security issue in satori/go.uuid@1.2.0. Maybe this library could be replaced with an alternative? (see https://github.com/satori/go.uuid/issues/120) To reproduce: ``` wget -qO- https://github.com/axllent/mailpit/releases/latest/download/mailpit-linux-amd64.tar.gz | tar xvz mailpit docker scout cves fs://mailpit ✓ File system read ✓ Indexed 51 packages ✗ Detected 1 vulnerable package with 1 vulnerability ## Overview │ Analyzed path ────────────────────┼────────────────────────────── Target │ fs://mailpit vulnerabilities │ 1C 0H 0M 0L ## Packages and Vulnerabilities 1C 0H 0M 0L github.com/satori/go.uuid 1.2.0 pkg:golang/github.com/satori/go.uuid@1.2.0 ✗ CRITICAL CVE-2021-3538 https://scout.docker.com/v/CVE-2021-3538 Affected range : <1.2.1-0.20181016170032-d91630c85102 Fixed version : 1.2.1-0.20181016170032-d91630c85102 1 vulnerability found in 1 package LOW 0 MEDIUM 0 HIGH 0 CRITICAL 1 ``` Thanks!

kerem closed this issue

2026-03-15 12:44:58 +03:00

kerem commented

2026-03-15 12:45:05 +03:00

Author

Owner

@axllent commented on GitHub (Oct 15, 2023):

Thanks for raising this issue. I'm surprised by this given that it was reported 2 years ago and still exists. I will look into a suitable replacement .

@axllent commented on GitHub (Oct 15, 2023): Thanks for raising this issue. I'm surprised by this given that it was reported 2 years ago and still exists. I will look into a suitable replacement .

kerem commented

2026-03-15 12:45:10 +03:00

Author

Owner

@axllent commented on GitHub (Oct 16, 2023):

This will be released in the next few hours 👍

@axllent commented on GitHub (Oct 16, 2023): This will be released in the next few hours :+1: