CVEs found in latest RIE release

[github-actions]

CVEs found in latest RIE release

product  version  location     cve_number     cvss_vector
go       1.24.4   /usr/bin/go  CVE-2024-3566  unknown

Are these resolved by building with the latest patch version of Go (go1.24.4)?:

No

[valerena]

This looks like an old CVE, which apparently affects all(?) versions of Go? or not? https://www.cve.org/CVERecord?id=CVE-2024-3566

There might be issues with the tool we're using to check. It hasn't found other CVEs and then it randomly started showing this one, which doesn't seem relevant really.

[valerena]

I disabled the workflow so it doesn't keep creating issues, but we need to investigate more about this false positive.

[valerena]

docker run -v $(pwd):/rie -w /rie anchore/grype dir:. -vv

returns no vulnerabilities

but what runs in the workflow:

pip install cve-bin-tool
python -m cve_bin_tool.cli . -r go -d REDHAT,OSV,GAD,CURL

returns this one above.