Executive brief
This advisory was withdrawn after investigation confirmed it does not impact any actual released version of the go-mysql database library. While the upstream go.uuid dependency had a theoretical weakness in unreleased code, the go-mysql package only used a confirmed-safe version, making this a false positive that was incorrectly flagged in the advisory database.
Technical details
The advisory references CVE-2021-3538, which involves predictable UUID generation due to weak randomness in github.com/satori/go.uuid. However, the vulnerability only affected specific unreleased commits (0ef6afb to d91630c) that never appeared in any tagged release. Analysis of go-mysql's dependency chain reveals it used github.com/satori/go.uuid version 1.2.0, which predates the vulnerable commit range and is therefore not affected. The vulnerability was remediated in go-mysql version 1.5.0 by replacing the entire go.uuid dependency with github.com/google/uuid, though this change was unnecessary for security reasons. This advisory was withdrawn on November 8, 2024, following clarification that the vulnerability does not affect any released version of the library.
Affected products
- go-mysql-org go-mysql < 1.5.0 (advisory withdrawn; no actual vulnerability present)
Timeline
- 2024-10-28: disclosed: Advisory published to GitHub Advisory Database
- 2024-11-08: other: Advisory withdrawn; confirmed vulnerability does not affect any released version