Since Trivy also scans for golang binaries, it reports the CVE-2020-29652 in the golang.org/x/crypto module.
A fixed version of that module is yet available.