- kubelet v1.28.1
  - kubelet v1.27.5
  - kubelet v1.26.8
  - kubelet v1.25.13
  - kubelet v1.24.17

This vulnerability was discovered by James Sturtevant @jsturtevant and Mark Rossetti @marosset during the process of fixing CVE-2023-3676 (that original CVE was reported by Tomer Peled @tomerpeled92)

		return errInvalidArgument
	}

	volumeDir, err := s.getVolDir(volume)
	if err != nil {
		return err
	}

	if err = Access(volumeDir); err != nil {
		// Volume does not exist we proceed to create.
		if osIsNotExist(err) {
			// Make a volume entry, with mode 0777 mkdir honors system umask.
			err = mkdirAll(volumeDir, 0o777, s.drivePath)
		}
		if osIsPermission(err) {
			return errDiskAccessDenied

			if err := p.queueMRFHeal(); err != nil && !osIsNotExist(err) {
				replLogIf(p.ctx, err)
			}
			pTimer.Reset(mrfQueueInterval)
		case <-p.ctx.Done():
			return
		}
	}
}

// process sends error logs to the heal channel for an attempt to heal replication.
func (p *ReplicationPool) queueMRFHeal() error {
	p.mrfMU.Lock()
	defer p.mrfMU.Unlock()

	if !p.initialized() {

   *   .build();
   * ```
   */
  internal class LegacyRedirectInterceptor : Interceptor {
    override fun intercept(chain: Interceptor.Chain): Response {
      val response = chain.proceed(chain.request())
      val code = response.code
      if (code != HTTP_TEMP_REDIRECT && code != HTTP_PERM_REDIRECT) return response
      val method = response.request.method

        .newBuilder()
        .addNetworkInterceptor(
          Interceptor { chain: Interceptor.Chain ->
            ifNoneMatch.compareAndSet(null, chain.request().header("If-None-Match"))
            chain.proceed(chain.request())
          },
        ).build()

    // Confirm the value is cached and intercepted.
    assertThat(get(url).body.string()).isEqualTo("A")
    assertThat(ifNoneMatch.get()).isEqualTo("v1")

    * inherit the environment from the primary process, so if the container was created with tty=false,that means the exec session's TERM variable will default to "dumb". Users can override this by setting TERM=xterm (or whatever is appropriate) to get the correct "smart" terminal behavior.

		EventName:  event.ObjectRestorePost,
		BucketName: bucket,
		Object:     objInfo,
		ReqParams:  extractReqParams(r),
		UserAgent:  r.UserAgent(),
		Host:       handlers.GetSourceIP(r),
	})
	// now process the restore in background
	go func() {
		rctx := GlobalContext
		if !rreq.SelectParameters.IsEmpty() {
			actualSize, err := objInfo.GetActualSize()
			if err != nil {

* Return apiserver panics as 500 errors instead terminating the apiserver process. ([#68001](https://github.com/kubernetes/kubernetes/pull/68001), [@sttts](https://github.com/sttts))

- github.com/prometheus/common: [v0.37.0 → v0.44.0](https://github.com/prometheus/common/compare/v0.37.0...v0.44.0)
- github.com/prometheus/procfs: [v0.8.0 → v0.10.1](https://github.com/prometheus/procfs/compare/v0.8.0...v0.10.1)
- github.com/seccomp/libseccomp-golang: [f33da4d → v0.10.0](https://github.com/seccomp/libseccomp-golang/compare/f33da4d...v0.10.0)

    /** The key of the message: Path to Crawl */
    public static final String LABELS_CRAWLING_CONFIG_PATH = "{labels.crawlingConfigPath}";

    /** The key of the message: Process Type */
    public static final String LABELS_PROCESS_TYPE = "{labels.processType}";

    /** The key of the message: Parameters */
    public static final String LABELS_PARAMETERS = "{labels.parameters}";