images: k8s-cloud-builder go1.18 and CVE updates for debian-base

[justaugustus]

What type of PR is this?

/kind feature
/area dependency release-eng/security

What this PR does / why we need it:

Part of #2307.

• [go1.18] Build k8s-cloud-builder:v1.24.0-go1.18beta1-bullseye.0
• debian-base: Build bullseye-v1.1.0 and buster-v1.10.0

/assign @cpanato @saschagrunert @puerco
/cc @kubernetes/release-engineering

Which issue(s) this PR fixes:

Special notes for your reviewer:

While working on the k/k PR, I noticed this note on upstream etcd image configs:

# TODO: move to k8s.gcr.io/build-image/debian-base:bullseye-v1.y.z when patched
FROM debian:bullseye-20210927

ref: etcd-io/etcd#13376, https://github.com/etcd-io/etcd/blob/42840d0fda78811be7ac0cdd18d7d2c3408268cc/Dockerfile-release.amd64#L1

...so let's get those patched!
/hold for checking vulns on debian-base images
cc: @hexfusion @mrueg

Does this PR introduce a user-facing change?

- images: k8s-cloud-builder go1.18 and CVE updates for debian-base
  - [go1.18] Build k8s-cloud-builder:v1.24.0-go1.18beta1-bullseye.0
  - debian-base: Build bullseye-v1.1.0 and buster-v1.10.0

[Verolop]

/lgtm

[Verolop]

/approved

[cpanato]

/lgmt

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cpanato, justaugustus, xmudrii

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [cpanato,justaugustus,xmudrii]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[justaugustus]

Before:

❯ time docker run -it aquasec/trivy:0.21.2 image --ignore-unfixed k8s.gcr.io/build-image/debian-base:bullseye-v1.0.0
2021-12-17T17:49:19.936Z	INFO	Need to update DB
2021-12-17T17:49:19.936Z	INFO	Downloading DB...
25.26 MiB / 25.26 MiB [-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 11.12 MiB p/s 3s
2021-12-17T17:49:25.589Z	INFO	Detected OS: debian
2021-12-17T17:49:25.590Z	INFO	Detecting Debian vulnerabilities...
2021-12-17T17:49:25.602Z	INFO	Number of language-specific files: 0

k8s.gcr.io/build-image/debian-base:bullseye-v1.0.0 (debian 11.0)
================================================================
Total: 6 (UNKNOWN: 0, LOW: 0, MEDIUM: 4, HIGH: 1, CRITICAL: 1)

+------------------+------------------+----------+-------------------+------------------+---------------------------------------+
|     LIBRARY      | VULNERABILITY ID | SEVERITY | INSTALLED VERSION |  FIXED VERSION   |                 TITLE                 |
+------------------+------------------+----------+-------------------+------------------+---------------------------------------+
| libgssapi-krb5-2 | CVE-2021-37750   | MEDIUM   | 1.18.3-6          | 1.18.3-6+deb11u1 | krb5: NULL pointer dereference        |
|                  |                  |          |                   |                  | in process_tgs_req() in               |
|                  |                  |          |                   |                  | kdc/do_tgs_req.c via a FAST inner...  |
|                  |                  |          |                   |                  | -->avd.aquasec.com/nvd/cve-2021-37750 |
+------------------+                  +          +                   +                  +                                       +
| libk5crypto3     |                  |          |                   |                  |                                       |
|                  |                  |          |                   |                  |                                       |
|                  |                  |          |                   |                  |                                       |
|                  |                  |          |                   |                  |                                       |
+------------------+                  +          +                   +                  +                                       +
| libkrb5-3        |                  |          |                   |                  |                                       |
|                  |                  |          |                   |                  |                                       |
|                  |                  |          |                   |                  |                                       |
|                  |                  |          |                   |                  |                                       |
+------------------+                  +          +                   +                  +                                       +
| libkrb5support0  |                  |          |                   |                  |                                       |
|                  |                  |          |                   |                  |                                       |
|                  |                  |          |                   |                  |                                       |
|                  |                  |          |                   |                  |                                       |
+------------------+------------------+----------+-------------------+------------------+---------------------------------------+
| libssl1.1        | CVE-2021-3711    | CRITICAL | 1.1.1k-1          | 1.1.1k-1+deb11u1 | openssl: SM2 Decryption               |
|                  |                  |          |                   |                  | Buffer Overflow                       |
|                  |                  |          |                   |                  | -->avd.aquasec.com/nvd/cve-2021-3711  |
+                  +------------------+----------+                   +                  +---------------------------------------+
|                  | CVE-2021-3712    | HIGH     |                   |                  | openssl: Read buffer overruns         |
|                  |                  |          |                   |                  | processing ASN.1 strings              |
|                  |                  |          |                   |                  | -->avd.aquasec.com/nvd/cve-2021-3712  |
+------------------+------------------+----------+-------------------+------------------+---------------------------------------+
docker run -it aquasec/trivy:0.21.2 image --ignore-unfixed   0.18s user 0.24s system 4% cpu 9.018 total

After:

❯ time docker run -it aquasec/trivy:0.21.2 image --ignore-unfixed gcr.io/k8s-staging-releng-test/debian-base:bullseye-v1.1.0
2021-12-17T17:50:29.580Z	INFO	Need to update DB
2021-12-17T17:50:29.580Z	INFO	Downloading DB...
25.26 MiB / 25.26 MiB [-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 14.74 MiB p/s 2s
2021-12-17T17:50:50.476Z	INFO	Detected OS: debian
2021-12-17T17:50:50.476Z	INFO	Detecting Debian vulnerabilities...
2021-12-17T17:50:50.488Z	INFO	Number of language-specific files: 0

gcr.io/k8s-staging-releng-test/debian-base:bullseye-v1.1.0 (debian 11.1)
========================================================================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

docker run -it aquasec/trivy:0.21.2 image --ignore-unfixed   0.15s user 0.17s system 1% cpu 22.040 total

/hold cancel

[justaugustus]

Promotion PR: kubernetes/k8s.io#3212

[justaugustus]

...so let's get those patched!
/hold for checking vulns on debian-base images
cc: @hexfusion @mrueg

Closing the loop with etcd-io/etcd#13546.