High and Critical CVEs in v0.24.0 ptcpdump binary

Describe the bug

Trivy finds several CVEs in v0.24.0:

usr/local/bin/ptcpdump (gobinary)
=================================
Total: 3 (HIGH: 2, CRITICAL: 1)

┌──────────────────────────┬────────────────┬──────────┬────────┬──────────────────────┬──────────────────────────────────┬───────────────────────────────────────────────────────────┐
│         Library          │ Vulnerability  │ Severity │ Status │  Installed Version   │          Fixed Version           │                           Title                           │
├──────────────────────────┼────────────────┼──────────┼────────┼──────────────────────┼──────────────────────────────────┼───────────────────────────────────────────────────────────┤
│ github.com/docker/docker │ CVE-2024-41110 │ CRITICAL │ fixed  │ v24.0.9+incompatible │ 23.0.15, 26.1.5, 27.1.1, 25.0.6  │ moby: Authz zero length regression                        │
│                          │                │          │        │                      │                                  │ https://avd.aquasec.com/nvd/cve-2024-41110                │
├──────────────────────────┼────────────────┼──────────┤        ├──────────────────────┼──────────────────────────────────┼───────────────────────────────────────────────────────────┤
│ k8s.io/kubernetes        │ CVE-2023-5528  │ HIGH     │        │ v1.24.17             │ 1.28.4, 1.27.8, 1.26.11, 1.25.16 │ kubernetes: Insufficient input sanitization in in-tree    │
│                          │                │          │        │                      │                                  │ storage plugin leads to privilege escalation...           │
│                          │                │          │        │                      │                                  │ https://avd.aquasec.com/nvd/cve-2023-5528                 │
├──────────────────────────┼────────────────┤          │        ├──────────────────────┼──────────────────────────────────┼───────────────────────────────────────────────────────────┤
│ stdlib                   │ CVE-2024-34156 │          │        │ 1.22.4               │ 1.22.7, 1.23.1                   │ encoding/gob: golang: Calling Decoder.Decode on a message │
│                          │                │          │        │                      │                                  │ which contains deeply nested structures...                │
│                          │                │          │        │                      │                                  │ https://avd.aquasec.com/nvd/cve-2024-34156                │
└──────────────────────────┴────────────────┴──────────┴────────┴──────────────────────┴──────────────────────────────────┴───────────────────────────────────────────────────────────┘

Exited with code exit status 1

How to reproduce it

Use trivy (or probably some other security scanner) to scan the ptcpdump binary or a docker image that includes the binary.

Expected behavior

No critical or high CVEs in the ptcpdump binary.

Environment

ptcpdump version:

ptcpdump version 0.24.0
libpcap version 1.10.5 (with TPACKET_V3)

OS: PRETTY_NAME="Ubuntu 22.04.5 LTS"
Kernel: Linux 0b5817783c8d 6.10.12-orbstack-00282-gd1783374c25e #26 SMP Wed Oct 2 10:16:55 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux

Additional context

N/A

mozillazg / ptcpdump

High and Critical CVEs in v0.24.0 ptcpdump binary #164