// Copyright (c) 2015-2021 MinIO, Inc.
//
// This file is part of MinIO Object Storage stack
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful

2A0C          ; mapped                 ; 222B 222B 222B 222B #3.2 QUADRUPLE INTEGRAL OPERATOR
2A0D..2A73    ; valid                  ;      ; NV8    # 3.2  FINITE PART INTEGRAL..EQUALS SIGN ABOVE TILDE OPERATOR
2A74          ; disallowed_STD3_mapped ; 003A 003A 003D #3.2  DOUBLE COLON EQUAL
2A75          ; disallowed_STD3_mapped ; 003D 003D     # 3.2  TWO CONSECUTIVE EQUALS SIGNS

aremark.no
arendal.no
arezzo.it
ariake.saga.jp
arida.wakayama.jp
aridagawa.wakayama.jp
arita.saga.jp
arkhangelsk.su
armenia.su
army
arna.no
arpa
arq.br
art
art.br
art.do
art.dz
art.ht
art.pl
art.sn
arte
arte.bo
arts.nf
arts.ro
arts.ve
arvanedge.ir
arvo.network
as
as.sh.cn
as.us
asago.hyogo.jp
asahi.chiba.jp
asahi.ibaraki.jp

**Fixed Versions**:
  - kube-apiserver v1.25.4
  - kube-apiserver v1.24.8
  - kube-apiserver v1.23.14
  - kube-apiserver v1.22.16

This vulnerability was reported by Richard Turnbull of NCC Group as part of the Kubernetes Audit


**CVSS Rating:** Medium (6.5) [CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

- NodeRestriction admission now validates the audience value that kubelet is requesting a service account token for is part of the pod spec volume. This change is introduced with a new kube-apiserver featuregate `ServiceAccountNodeAudienceRestriction` that's enabled by default. ([#128077](https://github.com/kubernetes/kubernetes/pull/128077), [@aramase](https://github.com/aramase))...

* remove time waiting after create storage account (save 25s) ([#56679](https://github.com/kubernetes/kubernetes/pull/56679), [@andyzhangx](https://github.com/andyzhangx))
* Add pvc as part of equivalence hash ([#56577](https://github.com/kubernetes/kubernetes/pull/56577), [@resouer](https://github.com/resouer))

- Graduated the `CSINodeExpandSecret` feature to Beta. This feature facilitates passing secrets to CSI driver as part of Node Expansion CSI operation. ([#115621](https://github.com/kubernetes/kubernetes/pull/115621), [@humblec](https://github.com/humblec))

- Fix a bug that Pods could stuck in the unschedulable pod pool 
  if they're rejected by PreEnqueue plugins that could change its result by a change in resources apart from Pods.
  
  DRA plugin is the only plugin that meets the criteria of the bug in in-tree, 
  and hence if you have `DynamicResourceAllocation` feature flag enabled, 

disk2/testbucket/file/9f6c3be2-463f-4771-a6c7-1204baaa3ff2/part.1 disk2/testbucket/file/xl.meta XL2 Æ X ¨Versions‘‚¤Type ¥V2ObjÞ ¢IDÄ ¤DDirÄ Ÿl;âF?Gq¦Ç ºª?ò¦EcAlgo £EcM £EcN §EcBSizeÒ §EcIndex ¦EcDist” ¨CSumAlgo ¨PartNums‘ ©PartETags‘ ©PartSizes‘Ò ªPartASizes‘Ò ¤SizeÒ ¥MTimeÓ ð ÞÍ &˜§MetaSys ¼x-minio-internal-inline-dataÄ true§MetaUsr‚¤etagÙ fffb6377948ebea75ad2¬content-type¸application/octet-streamÎ7£ï; disk1/testbucket/file/xl.meta 䱘′ ÆĀ腘嚨牥楳湯酳ꒂ祔数ꔁ㉖扏 ᄀ䦢쑄 ꐀ䑄物Ⴤ沟㽆煇잦Вꪺ䖦䅣杬ů䖣䵣ꌂ捅Ɏ䖧䉣楓敺Ò ꜀捅湉敤ɸ䖦䑣獩鑴̂...

- Fix a bug that Pods could stuck in the unschedulable pod pool 
  if they're rejected by PreEnqueue plugins that could change its result by a change in resources apart from Pods.
  
  DRA plugin is the only plugin that meets the criteria of the bug in in-tree, 
  and hence if you have `DynamicResourceAllocation` feature flag enabled,