Update tzdata package in cluster-proportional-autoscaler image

[jonesbr17]

DLA-2424-1 is a vulnerability impacting the cluster-proportional-autoscaler image. The tzdata package will need to be upgraded to resolve.

[MrHohn]

@jonesbr17 Thanks for reporting. I'm not sure about which versions are impacted as I don't find any import of the tzdata package. Also CPA doesn't use debian as the base image IFAICT. Could you give more context? Thanks.

[jonesbr17]

I'm seeing the issue on 1.8.3 as well as 1.7.1. From what I've seen, images built on distroless just need to be rebuilt to pick up the remedy.

[MrHohn]

Acked, I will add new release with the latest image from distroless.

[jonesbr17]

Update, the change to fix the vulnerability has been merged: kubernetes/kubernetes#98401
I do not see new images published yet however, will keep an eye out for that.

[jonesbr17]

There is a new release of gcr.io/distroless/static:nonroot available, so publishing a new release at this point should resolve the vulnerabilities

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

[MrHohn]

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[rtheis]

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[rtheis]

/remove-lifecycle stale

[rtheis]

@jonesbr17 has this problem been resolved?

[jonesbr17]

Yes this was resolved in release 1.8.4 and can be closed out.