Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package kubernetes1.36 for openSUSE:Factory checked in at 2026-07-28 17:55:52 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/kubernetes1.36 (Old) and /work/SRC/openSUSE:Factory/.kubernetes1.36.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "kubernetes1.36" Tue Jul 28 17:55:52 2026 rev:4 rq:1367910 version:1.36.3 Changes: -------- --- /work/SRC/openSUSE:Factory/kubernetes1.36/kubernetes1.36.changes 2026-07-02 20:15:44.706443906 +0200 +++ /work/SRC/openSUSE:Factory/.kubernetes1.36.new.2004/kubernetes1.36.changes 2026-07-28 18:01:03.707099107 +0200 @@ -1,0 +2,40 @@ +Mon Jul 27 06:16:44 UTC 2026 - Priyanka Saggu <[email protected]> + +- CVE-2020-8561: kubernetes: Webhook redirect in kube-apiserver, bsc#1190099 + + * TL;DR: Please refer to the official blogpost by the upstream Kubernetes project for details on mitigating the CVE: https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves/#cve-2020-8561-webhook-redirect-in-kube-apiserver + + ****Important note to users and administrators**** + + The Issue: The kube-apiserver follows HTTP redirects when communicating with admission webhooks. An actor capable of configuring an AdmissionWebhookConfiguration can redirect API server requests to internal, private networks. + + Why it remains unfixed: Restricting this behavior would require breaking the standard HTTP client behavior that many legitimate integrations rely on. + + Mitigation: Set the API server log level to less than 10 (to prevent logging response bodies) and disable dynamic profiling (--profiling=false) to prevent unauthorized log-level changes. + +------------------------------------------------------------------- +Mon Jul 27 05:28:14 UTC 2026 - Priyanka Saggu <[email protected]> + +- Update to version 1.36.3: + * DRA: roll back reserved state in allocateDevice + * Bump images and versions to golang 1.26.5 and update distroless-iptables + * stop logging missing optional container annotations + * Add e2e test for setting maps and slices to null via SSA + * Bump sigs.k8s.io/structured-merge-diff/v6 to v6.3.3 + * kubelet startPodSync: reuse the previous context to fix memory leak regression + * Make utf8 replacement char test pass on Go 1.27 + * Restore string JSON encoding of cri-api KeyValue + * kubeadm: treat already promoted learner as successful + * kubeadm: use KubernetesAPICallTimeout for mandatory kubeadm-config fetch + * Align DeviceTaintRule informer API version with handlers + * Fix job controller reporting active=0 during pod creation backoff + * flowcontrol: cover Required rule for spec.type and limitResponse.type + * flowcontrol: emit Required when spec.type or limitResponse.type is empty + * test/compatibility_lifecycle: resolve feature names from variables + * kubeadm: skip promote call when etcd member is already a voting member + +- Update .spec file to bump go version build requirements: + * `BuildRequires: go >= 1.26.5` + * ref: https://github.com/kubernetes/kubernetes/blob/v1.36.3/.go-version + +------------------------------------------------------------------- Old: ---- kubernetes-1.36.2.tar.xz New: ---- kubernetes-1.36.3.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kubernetes1.36.spec ++++++ --- /var/tmp/diff_new_pack.c4juRn/_old 2026-07-28 18:01:07.755240690 +0200 +++ /var/tmp/diff_new_pack.c4juRn/_new 2026-07-28 18:01:07.759240830 +0200 @@ -22,7 +22,7 @@ %define baseversionminus1 1.35 Name: kubernetes%{baseversion} -Version: 1.36.2 +Version: 1.36.3 Release: 0 Summary: Container Scheduling and Management License: Apache-2.0 @@ -49,7 +49,7 @@ Patch4: revert-coredns-image-renaming.patch BuildRequires: fdupes BuildRequires: git -BuildRequires: go >= 1.26.4 +BuildRequires: go >= 1.26.5 BuildRequires: go-go-md2man BuildRequires: golang-packaging BuildRequires: rsync ++++++ _service ++++++ --- /var/tmp/diff_new_pack.c4juRn/_old 2026-07-28 18:01:07.859244327 +0200 +++ /var/tmp/diff_new_pack.c4juRn/_new 2026-07-28 18:01:07.867244607 +0200 @@ -5,7 +5,7 @@ <param name="exclude">.git</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> - <param name="revision">v1.36.2</param> + <param name="revision">v1.36.3</param> <param name="changesgenerate">enable</param> </service> <service name="tar" mode="manual"/> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.c4juRn/_old 2026-07-28 18:01:07.907246006 +0200 +++ /var/tmp/diff_new_pack.c4juRn/_new 2026-07-28 18:01:07.911246147 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/kubernetes/kubernetes.git</param> - <param name="changesrevision">24e2b02af5543d7910c2bb074c7264df5a8f0467</param></service></servicedata> + <param name="changesrevision">0f29094e5b73085e3802ecc1298ecae13866bfe6</param></service></servicedata> (No newline at EOF) ++++++ kubernetes-1.36.2.tar.xz -> kubernetes-1.36.3.tar.xz ++++++ /work/SRC/openSUSE:Factory/kubernetes1.36/kubernetes-1.36.2.tar.xz /work/SRC/openSUSE:Factory/.kubernetes1.36.new.2004/kubernetes-1.36.3.tar.xz differ: char 15, line 1 ++++++ kubernetes.obsinfo ++++++ --- /var/tmp/diff_new_pack.c4juRn/_old 2026-07-28 18:01:08.055251183 +0200 +++ /var/tmp/diff_new_pack.c4juRn/_new 2026-07-28 18:01:08.059251323 +0200 @@ -1,5 +1,5 @@ name: kubernetes -version: 1.36.2 -mtime: 1781201347 -commit: 24e2b02af5543d7910c2bb074c7264df5a8f0467 +version: 1.36.3 +mtime: 1784743658 +commit: 0f29094e5b73085e3802ecc1298ecae13866bfe6
