Ingress-NGINX controller v1.3.0 images: getting flagged as critical vulnerable images

[sooryaveeravalli]

What scanner and version reported the CVE?
Vulnerability Scanning and Analytics / SHA Intel team reported this on our s360 dashboard under vulnerability management.

What CVE was reported in the scanner findings?

We got tagged for vulnerability names 'Alpine Linux Security Update for libxml2' and 'Alpine Linux Security Update for zlib' , please check the attached image for more details.

What versions of the controller did you test with?
We are already using the latest v1.3.0 Ingress-NGINX controller version.

Please provider other details that will help us determine the severity of the issue
Our services are getting marked as 'red' in SHA for vulnerability management, so please let us know when will a new version be released, so that we can communicate with the KPI owners to exclude us until then.

[k8s-ci-robot]

@sooryaveeravalli: This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[longwuyuan]

Fix for those CVE has merged.
Release with fixes/patches for the mentioned CVEs is expected to be GA by 4th ot 5th of September, 2022

[tshaiman]

tag in the new Helm chart (4.2.4 ) is still
tag: "v1.3.0"

[longwuyuan]

Its being fixed in #9023
The image and its sha is visible in the static manifests though. Under the deploy directory. Please check against that and close this issue or update fresh results. Thank a lot for reporting this.

[strongjz]

These CVE are resolved in the 1.3.1 release.

/close

[k8s-ci-robot]

@strongjz: Closing this issue.

In response to this:

These CVE are resolved in the 1.3.1 release.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.