Distroless currently only tracks debian 11 (bullseye) packages.
Debian tracking information at https://github.com/GoogleContainerTools/distroless/blob/main/debian_archives.bzl and generally is updated within 48 hours of debian publishing an update.
If a distroless image you are using contains a CVE or other vulnerability:
- ensure you are using a currently supported image
- find the appropriate debian security-tracker notice:
https://security-tracker.debian.org/tracker/CVE-XXXX-YYYYY, for example. - check if a fix is available for the appropriate debian version in the main/security channels (ex
bullseye,bullseye (security)).- if a fix is not yet available, do not file a bug, track it in your internal tracker until one becomes available.
- if a fix is available and it has been more than 48 hours, please let the team know by creating an issue and pointing to the CVE or vulnerability disclosure.