| id: GO-ID-PENDING |
| modules: |
| - module: github.com/apptainer/sif |
| non_go_versions: |
| - introduced: 1.2.1-0.20180103161547-0ef6afb2f6cd |
| - fixed: 1.2.1-0.20180404165556-75cca531ea76 |
| vulnerable_at: 1.7.0 |
| - module: github.com/apptainer/sif/v2 |
| vulnerable_at: 2.15.2 |
| - module: github.com/satori/go.uuid |
| versions: |
| - introduced: 1.2.1-0.20180103161547-0ef6afb2f6cd |
| - fixed: 1.2.1-0.20180404165556-75cca531ea76 |
| summary: github.com/satori/go.uuid has Predictable SIF UUID Identifiers |
| cves: |
| - CVE-2021-3538 |
| ghsas: |
| - GHSA-33m6-q9v5-62r7 |
| references: |
| - advisory: https://github.com/hpcng/sif/security/advisories/GHSA-33m6-q9v5-62r7 |
| - advisory: https://nvd.nist.gov/vuln/detail/CVE-2021-3538 |
| - fix: https://github.com/satori/go.uuid/commit/75cca531ea763666bc46e531da3b4c3b95f64557 |
| - fix: https://github.com/satori/go.uuid/pull/75 |
| - report: https://github.com/satori/go.uuid/issues/73 |
| - web: https://bugzilla.redhat.com/show_bug.cgi?id=1954376 |
| - web: https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSATORIGOUUID-72488 |
| notes: |
| - fix: 'github.com/satori/go.uuid: could not add vulnerable_at: could not find tagged version between introduced and fixed' |
| source: |
| id: GHSA-33m6-q9v5-62r7 |
| created: 1999-01-01T00:00:00Z |
| review_status: UNREVIEWED |
