CVE-2022-40897 in Python runtime

[jenshonkan84]

Describe the bug I have just started to test out buildpacks. When I build my little python API I can see that the Container Security Scanner finds a CVE marked as HIGH CVE-2022-40897.

Would be great if someone could fix that. :)

Additional context How are you using GCP buildpacks?

• [ ] pack and the gcr.io/buildpacks/builder
• [ ] Cloud Functions
• [ ] Cloud Run
• [X] Cloud Build
• [ ] App Engine Standard
• [ ] App Engine Flex

Did this used to work? (Yes/No) Was this working before? When did you start noticing these errors?

What language is your project primarily written in? Python

Steps To Reproduce Steps to reproduce the behavior:

1. gcloud builds submit --pack builder=gcr.io/buildpacks/builder:latest,image=<image_name>

Screenshot:

[paul-feng-github]

@jenshonkan84 We are working on upgrading setuptools version for python311. I'll let you know when it is ready.

[paul-feng-github]

@jenshonkan84 All python311 runtimes have been updated. CVE-2022-40897 is fixed.

[jenshonkan84]

Thx! I can confirm it is fixed. But... Now it looks like there is a Critical CVE instead.

Sorry if I am pushing this. But I just want to make you aware of it. This is related to Go...

[paul-feng-github]

What go version were you using? Could you please provide more details?