Releases do not include available security fix for CVE-2024-34156[HIGH]

[G-Tarik]

What happened:
At least these versions:
Latest Release:1.29.9 (released: 2024-09-10)
Latest Release:1.30.5 (released: 2024-09-10)
Latest Release:1.31.1 (released: 2024-09-11)
did not include fix for CVE-2024-34156 which was released in go1.22.7 on 2024-09-05. Trivy scanner reports installed version 1.22.6 for all of them.

What you expected to happen:
CVE-2024-34156 fix is included

How to reproduce it (as minimally and precisely as possible):

1. Build docker images with Dockerfile:

FROM python:3.10-alpine

RUN wget "https://dl.k8s.io/release/v1.29.9/bin/linux/amd64/kubectl" && \
    wget "https://dl.k8s.io/v1.29.9/bin/linux/amd64/kubectl.sha256" && \
    echo "$(cat kubectl.sha256)  kubectl" | sha256sum -c && \
    install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl

2. Scan the image with Trivy:

trivy clean --scan-cache
trivy image  --scanners vuln --no-progress --severity HIGH,CRITICAL --ignore-unfixed $IMAGE

[k8s-ci-robot]

This issue is currently awaiting triage.

SIG CLI takes a lead on issue triage for this repo, but any Kubernetes member can accept issues by applying the triage/accepted label.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[dims]

next versions of the different stable branches will pick up the newer golang, if you really need it, please compile kubectl from source with the golang that you need.

/close

[k8s-ci-robot]

@dims: Closing this issue.

In response to this:

next versions of the different stable branches will pick up the newer golang, if you really need it, please compile kubectl from source with the golang that you need.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.