Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package kubernetes1.35 for openSUSE:Factory checked in at 2026-07-28 17:55:55 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/kubernetes1.35 (Old) and /work/SRC/openSUSE:Factory/.kubernetes1.35.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "kubernetes1.35" Tue Jul 28 17:55:55 2026 rev:8 rq:1367911 version:1.35.7 Changes: -------- --- /work/SRC/openSUSE:Factory/kubernetes1.35/kubernetes1.35.changes 2026-07-02 20:15:47.198528794 +0200 +++ /work/SRC/openSUSE:Factory/.kubernetes1.35.new.2004/kubernetes1.35.changes 2026-07-28 18:01:30.448034365 +0200 @@ -1,0 +2,34 @@ +Mon Jul 27 06:14:23 UTC 2026 - Priyanka Saggu <[email protected]> + +- CVE-2020-8561: kubernetes: Webhook redirect in kube-apiserver, bsc#1190099 + + * TL;DR: Please refer to the official blogpost by the upstream Kubernetes project for details on mitigating the CVE: https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves/#cve-2020-8561-webhook-redirect-in-kube-apiserver + + ****Important note to users and administrators**** + + The Issue: The kube-apiserver follows HTTP redirects when communicating with admission webhooks. An actor capable of configuring an AdmissionWebhookConfiguration can redirect API server requests to internal, private networks. + + Why it remains unfixed: Restricting this behavior would require breaking the standard HTTP client behavior that many legitimate integrations rely on. + + Mitigation: Set the API server log level to less than 10 (to prevent logging response bodies) and disable dynamic profiling (--profiling=false) to prevent unauthorized log-level changes. + +------------------------------------------------------------------- +Mon Jul 27 05:29:40 UTC 2026 - Priyanka Saggu <[email protected]> + +- Update to version 1.35.7: + * Bump images and versions to golang 1.25.12 and update distroless-iptables + * stop logging missing optional container annotations + * Make utf8 replacement char test pass on Go 1.27 + * Restore string JSON encoding of cri-api KeyValue + * kubeadm: treat already promoted learner as successful + * kubeadm: use KubernetesAPICallTimeout for mandatory kubeadm-config fetch + * Update google.golang.org/protobuf to v1.36.12-0.20260120151049-f2248ac996af + * Fix job controller reporting active=0 during pod creation backoff + * test/compatibility_lifecycle: resolve feature names from variables + * kubeadm: skip promote call when etcd member is already a voting member + +- Update .spec file to bump go version build requirements: + * `BuildRequires: go >= 1.25.12` + * ref: https://github.com/kubernetes/kubernetes/blob/v1.35.7/.go-version + +------------------------------------------------------------------- Old: ---- kubernetes-1.35.6.tar.xz New: ---- kubernetes-1.35.7.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kubernetes1.35.spec ++++++ --- /var/tmp/diff_new_pack.HA4pbo/_old 2026-07-28 18:01:36.376241703 +0200 +++ /var/tmp/diff_new_pack.HA4pbo/_new 2026-07-28 18:01:36.392242262 +0200 @@ -22,7 +22,7 @@ %define baseversionminus1 1.34 Name: kubernetes%{baseversion} -Version: 1.35.6 +Version: 1.35.7 Release: 0 Summary: Container Scheduling and Management License: Apache-2.0 @@ -51,7 +51,7 @@ Patch5: revert-coredns-image-renaming.patch BuildRequires: fdupes BuildRequires: git -BuildRequires: go >= 1.25.11 +BuildRequires: go >= 1.25.12 BuildRequires: go-go-md2man BuildRequires: golang-packaging BuildRequires: rsync ++++++ _service ++++++ --- /var/tmp/diff_new_pack.HA4pbo/_old 2026-07-28 18:01:36.892260105 +0200 +++ /var/tmp/diff_new_pack.HA4pbo/_new 2026-07-28 18:01:36.944261995 +0200 @@ -5,7 +5,7 @@ <param name="exclude">.git</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> - <param name="revision">v1.35.6</param> + <param name="revision">v1.35.7</param> <param name="changesgenerate">enable</param> </service> <service name="tar" mode="manual"/> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.HA4pbo/_old 2026-07-28 18:01:37.068266500 +0200 +++ /var/tmp/diff_new_pack.HA4pbo/_new 2026-07-28 18:01:37.100267662 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/kubernetes/kubernetes.git</param> - <param name="changesrevision">fc0e7a6ca50f7ce368f9a5516e1716b473ed3a26</param></service></servicedata> + <param name="changesrevision">96cb9ab4201d88ce5e549fde047a686171838fdb</param></service></servicedata> (No newline at EOF) ++++++ kubernetes-1.35.6.tar.xz -> kubernetes-1.35.7.tar.xz ++++++ /work/SRC/openSUSE:Factory/kubernetes1.35/kubernetes-1.35.6.tar.xz /work/SRC/openSUSE:Factory/.kubernetes1.35.new.2004/kubernetes-1.35.7.tar.xz differ: char 15, line 1 ++++++ kubernetes.obsinfo ++++++ --- /var/tmp/diff_new_pack.HA4pbo/_old 2026-07-28 18:01:37.712289894 +0200 +++ /var/tmp/diff_new_pack.HA4pbo/_new 2026-07-28 18:01:37.732290621 +0200 @@ -1,5 +1,5 @@ name: kubernetes -version: 1.35.6 -mtime: 1781201107 -commit: fc0e7a6ca50f7ce368f9a5516e1716b473ed3a26 +version: 1.35.7 +mtime: 1784742714 +commit: 96cb9ab4201d88ce5e549fde047a686171838fdb
