- kube-apiserver v1.22.16

This vulnerability was reported by Richard Turnbull of NCC Group as part of the Kubernetes Audit


**CVSS Rating:** Medium (6.5) [CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

### CVE-2022-3294: Node address isn't always verified when proxying

 * Prefer to alternate IP addresses from different address families, (IPv6 / IPv4), starting with IPv6.
 * Don't start a new attempt until 250 ms after the most recent attempt was started.
 * Keep whichever TCP connection succeeds first and cancel all the others.
 * Race TCP only. Only attempt a TLS handshake on the winning TCP connection.

import org.jspecify.annotations.Nullable;
import org.junit.Ignore;

/**
 * Base class for map testers.
 *
 * <p>TODO: see how much of this is actually needed once Map testers are written. (It was cloned
 * from AbstractCollectionTester.)
 *
 * @param <K> the key type of the map to be tested.
 * @param <V> the value type of the map to be tested.
 * @author George van den Driessche
 */
@GwtCompatible

        SMBUtil.writeInt4(maxReceiveSize, data, idx);
        idx += 4;
        SMBUtil.writeInt4(maxFragmentedSize, data, idx);

        return data;
    }

    /**
     * Check if negotiation was successful
     *
     * @return true if successful
     */
    public boolean isSuccess() {
        return status == STATUS_SUCCESS;
    }

    // Getters and setters

    /**

// restartProcess starts a new process passing it the active fd's. It
// doesn't fork, but starts a new process using the same environment and
// arguments as when it was originally started. This allows for a newly
// deployed binary to be started. It returns the pid of the newly started
// process when successful.
func restartProcess() error {
	if runtime.GOOS == globalWindowsOSName {

const lockMutexWaitLimit = 1000

// lockRequesterInfo stores various info from the client for each lock that is requested.
type lockRequesterInfo struct {
	Name            string // name of the resource lock was requested for
	Writer          bool   // Bool whether write or read lock.
	UID             string // UID to uniquely identify request of client.
	Timestamp       int64  // Timestamp set at the time of initialization.

./mc ready minioadm

./mc ls minioadm/

./mc admin config set minioadm/ api root_access=off

sleep 3s # let things settle a little

./mc ls minioadm/
if [ $? -eq 0 ]; then
	echo "listing succeeded, 'minioadmin' was not disabled"
	exit 1
fi

set -e

killall -9 minio

export MINIO_API_ROOT_ACCESS=on
for ((i = 0; i < $((nr_servers)); i++)); do
	(minio server --address ":$((9100 + i))" $args 2>&1 >/tmp/log$i.txt) &

        assertFalse(filter.accept(mockDir, "image.png"), "Should reject non-.txt files");
        assertFalse(filter.accept(mockDir, null), "Should reject null names");

        // Verify getPath was called three times (once for each accept call)
        verify(mockDir, times(3)).getPath();
        verifyNoMoreInteractions(mockDir);
    }

    /**

# When we use Patchelf versions <0.12, those shared libraries end up with a
# corrupted PT_NOTE program header. This was fixed in v0.12, see https://github.com/NixOS/patchelf/commit/43a33482b501b0f5ee9da312aabfca3806570cc9.

padding:.25rem .5rem;margin-top:.1rem;font-size:.875rem;color:#fff;background-color:var(--bs-success);border-radius:var(--bs-border-radius)}.is-valid~.valid-feedback,.is-valid~.valid-tooltip,.was-validated :valid~.valid-feedback,.was-validated :valid~.valid-tooltip{display:block}.form-control.is-valid,.was-validated .form-control:valid{border-color:var(--bs-form-valid-border-color);padding-right:calc(1.5em + .75rem);background-image:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg'...