Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package kubernetes1.34 for openSUSE:Factory checked in at 2026-07-28 17:55:58 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/kubernetes1.34 (Old) and /work/SRC/openSUSE:Factory/.kubernetes1.34.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "kubernetes1.34" Tue Jul 28 17:55:58 2026 rev:10 rq:1367912 version:1.34.10 Changes: -------- --- /work/SRC/openSUSE:Factory/kubernetes1.34/kubernetes1.34.changes 2026-07-02 20:15:49.290600055 +0200 +++ /work/SRC/openSUSE:Factory/.kubernetes1.34.new.2004/kubernetes1.34.changes 2026-07-28 18:02:04.501263037 +0200 @@ -1,0 +2,36 @@ +Mon Jul 27 06:21:03 UTC 2026 - Priyanka Saggu <[email protected]> + +- CVE-2020-8561: kubernetes: Webhook redirect in kube-apiserver, bsc#1190099 + + * TL;DR: Please refer to the official blogpost by the upstream Kubernetes project for details on mitigating the CVE: https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves/#cve-2020-8561-webhook-redirect-in-kube-apiserver + + ****Important note to users and administrators**** + + The Issue: The kube-apiserver follows HTTP redirects when communicating with admission webhooks. An actor capable of configuring an AdmissionWebhookConfiguration can redirect API server requests to internal, private networks. + + Why it remains unfixed: Restricting this behavior would require breaking the standard HTTP client behavior that many legitimate integrations rely on. + + Mitigation: Set the API server log level to less than 10 (to prevent logging response bodies) and disable dynamic profiling (--profiling=false) to prevent unauthorized log-level changes. + +------------------------------------------------------------------- +Mon Jul 27 06:01:03 UTC 2026 - Priyanka Saggu <[email protected]> + +- Update to version 1.34.10: + * Bump images and versions to golang 1.25.12 and update distroless-iptables + * stop logging missing optional container annotations + * Make utf8 replacement char test pass on Go 1.27 + * Restore string JSON encoding of cri-api KeyValue + * kubeadm: treat already promoted learner as successful + * kubeadm: use KubernetesAPICallTimeout for mandatory kubeadm-config fetch + * Update google.golang.org/protobuf to v1.36.12-0.20260120151049-f2248ac996af + * Fix job controller reporting active=0 during pod creation backoff + * kubelet: defer CRI fallback removal to 1.38 + * test/compatibility_lifecycle: resolve feature names from variables + * kubeadm: skip promote call when etcd member is already a voting member + * test: Fix data race on policy refresh interval + +- Update .spec file to bump go version build requirements: + * `BuildRequires: go >= 1.25.12` + * ref: https://github.com/kubernetes/kubernetes/blob/v1.34.10/.go-version + +------------------------------------------------------------------- Old: ---- kubernetes-1.34.9.tar.xz New: ---- kubernetes-1.34.10.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kubernetes1.34.spec ++++++ --- /var/tmp/diff_new_pack.g9zYCg/_old 2026-07-28 18:02:08.697415467 +0200 +++ /var/tmp/diff_new_pack.g9zYCg/_new 2026-07-28 18:02:08.701415613 +0200 @@ -22,7 +22,7 @@ %define baseversionminus1 1.33 Name: kubernetes%{baseversion} -Version: 1.34.9 +Version: 1.34.10 Release: 0 Summary: Container Scheduling and Management License: Apache-2.0 @@ -51,7 +51,7 @@ Patch5: revert-coredns-image-renaming.patch BuildRequires: fdupes BuildRequires: git -BuildRequires: go >= 1.25.11 +BuildRequires: go >= 1.25.12 BuildRequires: go-go-md2man BuildRequires: golang-packaging BuildRequires: rsync ++++++ _service ++++++ --- /var/tmp/diff_new_pack.g9zYCg/_old 2026-07-28 18:02:08.821419972 +0200 +++ /var/tmp/diff_new_pack.g9zYCg/_new 2026-07-28 18:02:08.825420118 +0200 @@ -5,7 +5,7 @@ <param name="exclude">.git</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> - <param name="revision">v1.34.9</param> + <param name="revision">v1.34.10</param> <param name="changesgenerate">enable</param> </service> <service name="tar" mode="manual"/> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.g9zYCg/_old 2026-07-28 18:02:08.849420989 +0200 +++ /var/tmp/diff_new_pack.g9zYCg/_new 2026-07-28 18:02:08.853421135 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/kubernetes/kubernetes.git</param> - <param name="changesrevision">ad7c7374b74c04d07ea041d367ecb1a526bdf758</param></service></servicedata> + <param name="changesrevision">bd6c4ad159ac77a879838b8f14f23a49bf97de5f</param></service></servicedata> (No newline at EOF) ++++++ kubernetes-1.34.9.tar.xz -> kubernetes-1.34.10.tar.xz ++++++ /work/SRC/openSUSE:Factory/kubernetes1.34/kubernetes-1.34.9.tar.xz /work/SRC/openSUSE:Factory/.kubernetes1.34.new.2004/kubernetes-1.34.10.tar.xz differ: char 15, line 1 ++++++ kubernetes.obsinfo ++++++ --- /var/tmp/diff_new_pack.g9zYCg/_old 2026-07-28 18:02:08.997426366 +0200 +++ /var/tmp/diff_new_pack.g9zYCg/_new 2026-07-28 18:02:09.001426511 +0200 @@ -1,5 +1,5 @@ name: kubernetes -version: 1.34.9 -mtime: 1781199428 -commit: ad7c7374b74c04d07ea041d367ecb1a526bdf758 +version: 1.34.10 +mtime: 1784742389 +commit: bd6c4ad159ac77a879838b8f14f23a49bf97de5f
