...

- Systems running `iptables` 1.8.0 or newer should start it in legacy mode. Please note that this affects all versions of Kubernetes and not only v1.16.0. For more detailed information about the issue and how to apply a workaround, please refer to the official documentation
- Generating informers for packages in directories containing dots in their name is broken. This will be fixed in v1.16.1. ([#82860](https://github.com/kubernetes/kubernetes/issues/82860))

### `TokenRequest` / `TokenRequestProjection` graduates to General Availability

Service account tokens bound to a pod is now a stable feature. The feature gates will be removed in 1.21 release. For more information, refer to notes below on the changelogs.

### RuntimeClass feature graduates to General Availability.

There are no known mitigations to this vulnerability.

#### Fixed Versions

- kubelet v1.22.14
- kubelet v1.23.11
- kubelet v1.24.5
- kubelet v1.25.0


To upgrade, refer to this documentation _For core Kubernetes:_ https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster 

### Detection

// Implementation of the counterCrypt function in assembler. // Original loop is unrolled to allow for multiple encryption // streams to be done in parallel, which is achieved by interleaving // vcipher instructions from each stream. This is also referred to as // stitching, and provides significant performance improvements. // Some macros are defined which enable execution for big or little // endian as well as different ISA targets. //func (g *gcmAsm) counterCrypt(out, in []byte, counter *[gcmBlockSize]byte,...

// Implementation of the counterCrypt function in assembler. // Original loop is unrolled to allow for multiple encryption // streams to be done in parallel, which is achieved by interleaving // vcipher instructions from each stream. This is also referred to as // stitching, and provides significant performance improvements. // Some macros are defined which enable execution for big or little // endian as well as different ISA targets. //func (g *gcmAsm) counterCrypt(out, in []byte, counter *[gcmBlockSize]byte,...