Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package kubernetes1.33 for openSUSE:Factory checked in at 2026-07-28 17:56:02 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/kubernetes1.33 (Old) and /work/SRC/openSUSE:Factory/.kubernetes1.33.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "kubernetes1.33" Tue Jul 28 17:56:02 2026 rev:15 rq:1367913 version:1.33.13 Changes: -------- --- /work/SRC/openSUSE:Factory/kubernetes1.33/kubernetes1.33.changes 2026-07-02 20:15:51.230666139 +0200 +++ /work/SRC/openSUSE:Factory/.kubernetes1.33.new.2004/kubernetes1.33.changes 2026-07-28 18:02:29.658156992 +0200 @@ -1,0 +2,15 @@ +Mon Jul 27 06:12:29 UTC 2026 - Priyanka Saggu <[email protected]> + +- CVE-2020-8561: kubernetes: Webhook redirect in kube-apiserver, bsc#1190099 + + * TL;DR: Please refer to the official blogpost by the upstream Kubernetes project for details on mitigating the CVE: https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves/#cve-2020-8561-webhook-redirect-in-kube-apiserver + + ****Important note to users and administrators**** + + The Issue: The kube-apiserver follows HTTP redirects when communicating with admission webhooks. An actor capable of configuring an AdmissionWebhookConfiguration can redirect API server requests to internal, private networks. + + Why it remains unfixed: Restricting this behavior would require breaking the standard HTTP client behavior that many legitimate integrations rely on. + + Mitigation: Set the API server log level to less than 10 (to prevent logging response bodies) and disable dynamic profiling (--profiling=false) to prevent unauthorized log-level changes. + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------
