Update tzdata package in cluster-proportional-autoscaler image about cluster-proportional-autoscaler HOT 13 CLOSED

Acked, I will add new release with the latest image from distroless.

from cluster-proportional-autoscaler.

Update, the change to fix the vulnerability has been merged: kubernetes/kubernetes#98401
I do not see new images published yet however, will keep an eye out for that.

from cluster-proportional-autoscaler.

Yes this was resolved in release 1.8.4 and can be closed out.

from cluster-proportional-autoscaler.

@jonesbr17 Thanks for reporting. I'm not sure about which versions are impacted as I don't find any import of the tzdata package. Also CPA doesn't use debian as the base image IFAICT. Could you give more context? Thanks.

from cluster-proportional-autoscaler.

I'm seeing the issue on 1.8.3 as well as 1.7.1. From what I've seen, images built on distroless just need to be rebuilt to pick up the remedy.

from cluster-proportional-autoscaler.

There is a new release of gcr.io/distroless/static:nonroot available, so publishing a new release at this point should resolve the vulnerabilities

from cluster-proportional-autoscaler.

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

from cluster-proportional-autoscaler.

/remove-lifecycle stale

from cluster-proportional-autoscaler.

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

from cluster-proportional-autoscaler.

/remove-lifecycle stale

from cluster-proportional-autoscaler.

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

from cluster-proportional-autoscaler.

/remove-lifecycle stale

from cluster-proportional-autoscaler.

@jonesbr17 has this problem been resolved?

from cluster-proportional-autoscaler.