### CVE-2022-3162: Unauthorized read of Custom Resources

A security issue was discovered in Kubernetes where users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group they are not authorized to read.

**Affected Versions**:
  - kube-apiserver v1.25.0 - v1.25.3
  - kube-apiserver v1.24.0 - v1.24.7

pkg io, func LimitReader(Reader, int64) Reader
pkg io, func MultiReader(...Reader) Reader
pkg io, func MultiWriter(...Writer) Writer
pkg io, func NewSectionReader(ReaderAt, int64, int64) *SectionReader
pkg io, func Pipe() (*PipeReader, *PipeWriter)
pkg io, func ReadAtLeast(Reader, []uint8, int) (int, error)
pkg io, func ReadFull(Reader, []uint8) (int, error)
pkg io, func TeeReader(Reader, Writer) Reader

- Windows runtime endpoints is now switched to `npipe:////./pipe/dockershim` from `tcp://localhost:3735`. ([#69516](https://github.com/kubernetes/kubernetes/pull/69516), [@feiskyer](https://github.com/feiskyer))

- Added categories column to the `kubectl api-resources` command's wide output (`-o wide`).

    ownership of such entity.

2. License Grants and Conditions
--------------------------------

2.1. Grants

Each Contributor hereby grants You a world-wide, royalty-free,
non-exclusive license:

(a) under intellectual property rights (other than patent or trademark)
    Licensable by such Contributor to use, reproduce, make available,

* kubectl annotate now supports --dry-run ([#34199](https://github.com/kubernetes/kubernetes/pull/34199), [@asalkeld](https://github.com/asalkeld))
* kubectl: Add external ip information to node when '-o wide' is used ([#33552](https://github.com/kubernetes/kubernetes/pull/33552), [@floreks](https://github.com/floreks))

            </ul>

            <p>This flexible condition mechanism allows for more precise control over profile
            activation, enabling developers to create profiles that respond to a wide range of
            environmental factors and project states.</p>
       ]]></description>
      <fields>
        <field>
          <name>activeByDefault</name>
          <version>4.0.0+</version>

whm.nl-ams.scw.cloud
whoswho
wi.us
wielun.pl
wien
wien.funkfeuer.at
wif.gov.pl
wiih.gov.pl
wiki
wiki.bo
wiki.br
williamhill
win
winb.gov.pl
windows
wine
winners
wios.gov.pl
witd.gov.pl
withgoogle.com
withyoutube.com
wiw.gov.pl
wix.run
wixsite.com
wixstudio.com
wixstudio.io
wjg.jp
wkz.gov.pl
wlocl.pl
wloclawek.pl

promise","fail","then","Callbacks","object","_","flag","firing","memory","fired","locked","list","queue","firingIndex","fire","once","stopOnFalse","remove","disable","lock","fireWith","Deferred","func","tuples","state","always","deferred","catch","pipe","fns","newDefer","tuple","returned","progress","notify","onFulfilled","onRejected","onProgress","maxDepth","depth","handler","special","that","mightThrow","TypeError","notifyWith","resolveWith","process","exceptionHook","rejectWith","getErrorHook...

- Added a new `tolerance` field to HorizontalPodAutoscaler, overriding the cluster-wide default. Enabled via the HPAConfigurableTolerance alpha feature gate. ([#130797](https://github.com/kubernetes/kubernetes/pull/130797), [@jm-franc](https://github.com/jm-franc)) [SIG API Machinery, Apps, Autoscaling, Etcd, Node, Scheduling and Testing]...