CVE-2021-3538 on Elastic Beanstalk?
I have an EC2 instance created by Elastic Beanstalk (platform is Docker running on 64bit Amazon Linux 2/4.0.2). When AWS Inspector does an agentless scan, it keeps flagging CVE-2021-3538 as a critical finding.
CVE-2021-3538 is an issue with an old version of the go.uuid package. As far as I can tell, it's being included automatically by elastic beanstalk.
opt/elasticbeanstalk/bin/platform-engine and opt/elasticbeanstalk/bin/publishlogs
I also see the same issue when deploying beanstalk using the latest version of Docker on Amazon Linux 2023/4.3.7
I haven't seen any mention of this CVE anywhere in the amazon linux security center. Is it a real security issue, or a false positive?
- Newest
- Most votes
- Most comments
I think, this is kinda explaining what is going on.
It's an old reference to a fixed issue.
Thank you. Yeah, looks like 1.2 was never actually vulnerable, so the issue is moot.