Repository: cadence-workflow/cadence (language: go)

Issue:
Golang 1.17.13 has several security vulnerabilities
**Version of Cadence server, and client(which language)**
This is very important to root cause bugs.
- Server version: `v0.24.0`
- Client version: N/A
- Client langauge: N/A

**Describe the bug**
A clear and concise description of what the bug is.

The base image `golang:1.17-alpine3.13` of builder uses Golang version [`1.17.3`](https://hub.docker.com/layers/golang/library/golang/1.17-alpine3.13/images/sha256-a9321c9d6637f000d119635ded9eca8b75f3919cd5bcd642ce5fad766af83ec0?context=explore) is detected for having many security vulnerabilities.
https://github.com/uber/cadence/blob/9949a22c1160c83675f0bde81c219e181baa1278/Dockerfile#L15

List of CVEs caused by Golang `1.17.3`:
- CVE-2022-23806 (critical) fixed in 1.17.7, 1.16.14
- CVE-2022-30580 (high) fixed in 1.18.3, 1.17.11
- CVE-2022-32189 (high) fixed in 1.18.5, 1.17.13
- CVE-2022-30635 (high) fixed in 1.18.4, 1.17.12
- CVE-2022-30633 (high) fixed in 1.18.4, 1.17.12
- CVE-2022-30632 (high) fixed in 1.18.4, 1.17.12
- CVE-2022-30631 (high) fixed in 1.18.4, 1.17.12
- CVE-2022-30630 (high) fixed in 1.18.4, 1.17.12
- CVE-2022-30629 (high) fixed in 1.18.3, 1.17.11
- CVE-2022-28327 (high) fixed in 1.18.1, 1.17.9
- CVE-2022-28131 (high) fixed in 1.18.4, 1.17.12
- CVE-2022-24921 (high) fixed in 1.17.8, 1.16.15
- CVE-2022-24675 (high) fixed in 1.18.1, 1.17.9
- CVE-2022-23773 (high) fixed in 1.17.7, 1.16.14
- CVE-2022-23772 (high) fixed in 1.17.7, 1.16.14
- CVE-2021-44716 (high) fixed in 1.17.5, 1.16.12 
- CVE-2022-32148 (medium) fixed in 1.18.4, 1.17.12 
- CVE-2022-1705 (medium) fixed in 1.18.4, 1.17.12 
- CVE-2022-1962 (medium) fixed in 1.18.4, 1.17.12

**To Reproduce**
Is the issue reproducible? 

Yes, run an image scan for Cadence Server `v0.24.0` image with any vulnerability scanner. In my case, it's Twistlock.

**Steps to reproduce the behavior:**
A clear and concise description of the reproduce steps.
```sh
# checkout to the latest release tag
git checkout v0.24.0

# build server image
docker build . -f Dockerfile -t ubercadence/server:master --build-arg TARGET=server && tlis ubercadence/server:master

# scan with any vulnerability scanner
/usr/local/bin/twistcli images scan --details ubercadence/server:master
```

**Expected behavior**
A clear and concise description of what you expected to happen.

N/A

**Screenshots**
If applicable, add screenshots to help explain your problem.

N/A

**Additional context**
Add any other context about the problem here, E.g. Stackstace, workflow history.

N/A



Discussion / hints:

Fix patch:
diff --git a/Dockerfile b/Dockerfile
index a725ea8e22b..7c906c3755d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,7 +4,7 @@ ARG TARGET=server
 ARG GOPROXY
 
 # Build tcheck binary
-FROM golang:1.17-alpine3.15 AS tcheck
+FROM golang:1.17.13-alpine3.15 AS tcheck
 
 WORKDIR /go/src/github.com/uber/tcheck
 
@@ -12,7 +12,7 @@ COPY go.* ./
 RUN go build -mod=readonly -o /go/bin/tcheck github.com/uber/tcheck
 
 # Build Cadence binaries
-FROM golang:1.17-alpine3.13 AS builder
+FROM golang:1.17.13-alpine3.15 AS builder
 
 ARG RELEASE_VERSION
 


Test patch: