### CVE-2023-3676: Insufficient input sanitization on Windows nodes leads to privilege escalation

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

**Affected Versions**:
  - kubelet <= v1.28.0
  - kubelet <= v1.27.4

}

func (p *xlStorageDiskIDCheck) checkDiskStale() error {
	if *p.diskID.Load() == emptyDiskID {
		// For empty disk-id we allow the call as the server might be
		// coming up and trying to read format.json or create format.json
		return nil
	}
	storedDiskID, err := p.storage.GetDiskID()
	if err != nil {
		// return any error generated while reading `format.json`
		return err
	}

# Configure short or long logs
build:short_logs --output_filter=DONT_MATCH_ANYTHING
build:verbose_logs --output_filter=

# Instruction set optimizations
# TODO(gunan): Create a feature in toolchains for avx/avx2 to
#   avoid having to define linux/win separately.
build:avx_linux --copt=-mavx
build:avx_linux --host_copt=-mavx
build:avx_win --copt=/arch:AVX

“Incorrect compilation” section below.
</p>

<h2 id="synchronization">Synchronization</h2>

<h3 id="init">Initialization</h3>

<p>
Program initialization runs in a single goroutine,
but that goroutine may create other goroutines,
which run concurrently.
</p>

<p class="rule">
If a package <code>p</code> imports package <code>q</code>, the completion of

labels.key_match_urls=Urls
labels.dict_stemmeroverride_configuration=Stemmer Override List
labels.dict_stemmeroverride_title=Stemmer Override List
labels.dict_stemmeroverride_list_link=List
labels.dict_stemmeroverride_link_create=Create New
labels.dict_stemmeroverride_link_edit=Edit
labels.dict_stemmeroverride_link_delete=Delete
labels.dict_stemmeroverride_link_details=Details
labels.dict_stemmeroverride_link_download=Download

or under the terms of any subsequent version published by the license
steward.

10.3. Modified Versions

If you create software not governed by this License, and you want to
create a new license for such software, you may create and use a
modified version of this License if you rename the license and remove
any references to the name of the license steward (except to note that

- Fix a panic when using invalid output format in kubectl create secret command ([#107347](https://github.com/kubernetes/kubernetes/pull/107347), [@rikatz](https://github.com/rikatz)) [SIG CLI]

  private static Test testsForRemoveAllAndRetainAll() {
    return ListTestSuiteBuilder.using(
            new TestStringListGenerator() {
              @Override
              public List<String> create(final String[] elements) {
                final List<String> delegate = newArrayList(elements);
                return new ForwardingList<String>() {
                  @Override

    return (Ordering<C>) NaturalOrdering.INSTANCE;
  }

  // Static factories

  /**
   * Returns an ordering based on an <i>existing</i> comparator instance. Note that it is
   * unnecessary to create a <i>new</i> anonymous inner class implementing {@code Comparator} just
   * to pass it in here. Instead, simply subclass {@code Ordering} and implement its {@code compare}
   * method directly.
   *

	if newCred.ParentUser != globalActiveCred.AccessKey {
		replLogIf(ctx, globalSiteReplicationSys.IAMChangeHook(ctx, madmin.SRIAMItem{
			Type: madmin.SRIAMItemSvcAcc,
			SvcAccChange: &madmin.SRSvcAccChange{
				Create: &madmin.SRSvcAccCreate{
					Parent:        newCred.ParentUser,
					AccessKey:     newCred.AccessKey,
					SecretKey:     newCred.SecretKey,
					Groups:        newCred.Groups,
					Name:          newCred.Name,