There are no known mitigations to this vulnerability.

#### Fixed Versions

- kubelet v1.22.14
- kubelet v1.23.11
- kubelet v1.24.5
- kubelet v1.25.0


To upgrade, refer to this documentation _For core Kubernetes:_ https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster 

### Detection

* Protobuf serialization does not distinguish between `[]` and `null`.

</p>

<pre>
lock(l)
defer unlock(l)  // unlocking happens before surrounding function returns

// prints 3 2 1 0 before surrounding function returns
for i := 0; i &lt;= 3; i++ {
	defer fmt.Print(i)
}

// f returns 42
func f() (result int) {
	defer func() {
		// result is accessed after it was set to 6 by the return statement
		result *= 7

Service trafficDistribution field has graduated to beta and is now available for configuration by default, without the need to enable any feature flag. Services that do not have the field configured will continue to operate with their existing behavior. Refer to the documentation https://kubernetes.io/docs/concepts/services-networking/service/#traffic-distribution for more details. ([#125838](https://github.com/kubernetes/kubernetes/pull/125838), [@gauravkghildiyal](https://github.com/gauravkghildiyal))...

- The Service trafficDistribution field, including the PreferClose option, has graduated
  to GA. Services that do not have the field configured will continue to operate
  with their existing behavior. Refer to the documentation
  https://kubernetes.io/docs/concepts/services-networking/service/#traffic-distribution

### OpenStack

- The `openstack-heat` provider for `kube-up` is deprecated and will be removed
  in a future release. Refer to Issue [#49213](https://github.com/kubernetes/kubernetes/issues/49213)
  for background information.

### Scheduling

  - Opaque Integer Resources (OIRs) are deprecated and will be removed in

    </magic>
    <glob pattern="*.emlx"/>
    <sub-class-of type="text/x-tika-text-based-message"/>
  </mime-type>

  <mime-type type="application/x-endnote-refer">
    <magic priority="80">
      <match value="%A " type="string" offset="0:50">
        <match value="\n%D " type="string" offset="0:1000">
          <match value="\n%T " type="string" offset="0:1000"/>

For detailed release notes on the three alpha features from SIG AWS, please refer to the following Changelogs:

- [aws-alb-ingress-controller v1.0.0](https://github.com/kubernetes-sigs/aws-alb-ingress-controller/releases/tag/v1.0.0)

1.32 regression in with the ServiceAccountNodeAudienceRestriction feature where `azureFile` volumes encounter "failed to get service accoount token attributes" errors. Reverts the `ServiceAccountNodeAudienceRestriction` feature to disabled in v1.32. Refer to https://github.com/kubernetes/kubernetes/issues/129935 for more details. If you're using in-tree inline volumes or in-tree persistent volumes whose CSI drivers depend on service account tokens, do not enable this feature in the 1.32 release. ([...

Sa(e,a,t,s,!1)}M.createFromInputFallback=t("value provided is not in a recognized RFC2822 or ISO format. moment construction falls back to js Date(), which is not reliable across all browsers and versions. Non RFC2822/ISO date formats are discouraged. Please refer to http://momentjs.com/guides/#/warnings/js-date/ for more info.",function(e){e._d=new Date(e._i+(e._useUTC?" UTC":""))}),M.ISO_8601=function(){},M.RFC_2822=function(){};var ja=t("moment().min is deprecated, use moment.max instead. http://momentjs...