- kubelet v1.27.8
  - kubelet v1.26.11
  - kubelet v1.25.16

This vulnerability was reported by Tomer Peled @tomerpeled92"


**CVSS Rating:** High (7.2) [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

## Dependencies

### Added
_Nothing has changed._

### Changed
_Nothing has changed._

### Removed

  - kubelet 1.31.5
  - kubelet 1.32.1

This vulnerability was reported by Peled, Tomer and mitigated by Aravindh Puthiyaprambil.


**CVSS Rating:** Medium (5.9) [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N)

## Changes by Kind

### API Change

	o = bts
	return
}

// Msgsize returns an upper bound estimate of the number of bytes occupied by the serialized message
func (z *MetricsGroupOpts) Msgsize() (s int) {
	s = 1 + 22 + msgp.BoolSize + 24 + msgp.BoolSize + 31 + msgp.BoolSize + 28 + msgp.BoolSize + 16 + msgp.BoolSize + 11 + msgp.BoolSize + 29 + msgp.BoolSize + 19 + msgp.BoolSize + 23 + msgp.BoolSize + 26 + msgp.BoolSize + 32 + msgp.BoolSize + 22 + msgp.BoolSize
	return
}

pkg syscall (darwin-arm64), const AF_LOCAL ideal-int
pkg syscall (darwin-arm64), const AF_MAX = 40
pkg syscall (darwin-arm64), const AF_MAX ideal-int
pkg syscall (darwin-arm64), const AF_NATM = 31
pkg syscall (darwin-arm64), const AF_NATM ideal-int
pkg syscall (darwin-arm64), const AF_NDRV = 27
pkg syscall (darwin-arm64), const AF_NDRV ideal-int
pkg syscall (darwin-arm64), const AF_NETBIOS = 33

- **MS-SMB2 Section 2.2.13.2.12**: SMB2_CREATE_REQUEST_LEASE_V2
- **MS-SMB2 Section 3.2.1.4**: Durable Open Scavenger Timer

## 3. Handle Types and Capabilities

### 3.1 Handle Types
```java
public enum HandleType {
    NONE(0),                    // No durability
    DURABLE_V1(1),              // SMB 2.1 - survives network loss
    DURABLE_V2(2),              // SMB 3.0 - with timeout

  - kube-apiserver v1.23.14
  - kube-apiserver v1.22.16

This vulnerability was reported by Yuval Avrahami of Palo Alto Networks


**CVSS Rating:** Medium (6.6) [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)

## Changes by Kind

### API Change

  }

  @Test fun streamIdHasReservedBit() {
    val writer = Http2Writer(Buffer(), true)
    assertFailsWith<IllegalArgumentException> {
      var streamId = 3
      streamId = streamId or (1L shl 31).toInt() // set reserved bit
      writer.frameHeader(streamId, Http2.INITIAL_MAX_FRAME_SIZE, Http2.TYPE_DATA, FLAG_NONE)
    }.also { expected ->
      assertThat(expected.message).isEqualTo("reserved bit set: -2147483645")

  - kube-apiserver v1.32.8
  - kube-apiserver v1.33.4

This vulnerability was reported by Paul Viossat.


**CVSS Rating:** Medium (6.7) [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L)

## Changes by Kind

### API Change

        return true;
      }
      return super.equals(object);
    }

    @Override
    public int hashCode() {
      int result = 1;
      for (int i = start; i < end; i++) {
        result = 31 * result + Integer.hashCode(array[i]);
      }
      return result;
    }

    @Override
    public String toString() {
      StringBuilder builder = new StringBuilder(size() * 5);

		// Put an empty object with a trailing slash
		30: {bucketName: bucket, objName: "emptydir/", inputData: []byte{}, expectedMd5: getMD5Hash([]byte{})},
		// Put an object inside the empty directory
		31: {bucketName: bucket, objName: "emptydir/" + object, inputData: data, inputDataSize: int64(len(data)), expectedMd5: getMD5Hash(data)},
		// Put the empty object with a trailing slash again (refer to Test case 30), this needs to succeed