Fix CVE-2024-12797 (#642)

* upgrade helm to 3.19.0

* update test docker to debian11

* add cryptography>=44.0.1 version to fix CVE-2024-12797, and rollback k8s to 1.31 due to no 1.32 or 1.33 under kubernetes-release gcs

Author: kaiyangg

marketplace/deployer_envsubst_base/Dockerfile

@@ -15,17 +15,18 @@ RUN pip3 install \
       wheel \
       pyOpenSSL \
       pyyaml \
-      six
+      six \
+      cryptography>=44.0.1
 
-RUN for full_version in 1.33.5 1.34.0;  \
+RUN for full_version in 1.30.4 1.31.0;  \
      do \
         version=${full_version%.*} \
         && mkdir -p /opt/kubectl/$version \
         && wget -q -O /opt/kubectl/$version/kubectl \
             https://storage.googleapis.com/kubernetes-release/release/v$full_version/bin/linux/amd64/kubectl \
         && chmod 755 /opt/kubectl/$version/kubectl; \
      done;
-RUN ln -s /opt/kubectl/1.33 /opt/kubectl/default
+RUN ln -s /opt/kubectl/1.31 /opt/kubectl/default
 
 COPY marketplace/deployer_envsubst_base/* /bin/
 COPY marketplace/deployer_util/* /bin/

marketplace/deployer_helm_base/Dockerfile

@@ -14,17 +14,18 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 RUN pip3 install \
       wheel \
       pyOpenSSL \
-      pyyaml
+      pyyaml \
+      cryptography>=44.0.1
 
-RUN for full_version in 1.33.5 1.34.0;  \
+RUN for full_version in 1.30.4 1.31.0;  \
      do \
         version=${full_version%.*} \
         && mkdir -p /opt/kubectl/$version \
         && wget -q -O /opt/kubectl/$version/kubectl \
             https://storage.googleapis.com/kubernetes-release/release/v$full_version/bin/linux/amd64/kubectl \
         && chmod 755 /opt/kubectl/$version/kubectl; \
      done;
-RUN ln -s /opt/kubectl/1.33 /opt/kubectl/default
+RUN ln -s /opt/kubectl/1.31 /opt/kubectl/default
 
 RUN mkdir -p /bin/helm-downloaded \
     && wget -q -O /bin/helm-downloaded/helm.tar.gz \

marketplace/dev/Dockerfile

@@ -23,17 +23,18 @@ RUN echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] http://packages.c
 RUN pip3 install \
       wheel \
       pyOpenSSL \
-      pyyaml
+      pyyaml \
+      cryptography>=44.0.1
 
-RUN for full_version in 1.33.5 1.34.0;  \
+RUN for full_version in 1.30.4 1.31.0;  \
      do \
         version=${full_version%.*} \
         && mkdir -p /opt/kubectl/$version \
         && wget -q -O /opt/kubectl/$version/kubectl \
             https://storage.googleapis.com/kubernetes-release/release/v$full_version/bin/linux/amd64/kubectl \
         && chmod 755 /opt/kubectl/$version/kubectl; \
      done;
-RUN ln -s /opt/kubectl/1.33 /opt/kubectl/default
+RUN ln -s /opt/kubectl/1.31 /opt/kubectl/default
 
 RUN echo "deb [signed-by=/usr/share/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu jammy stable" | tee /etc/apt/sources.list.d/docker.list \
      && curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key --keyring /usr/share/keyrings/docker.gpg add - \