**Fixed Versions**:
  - kube-apiserver v1.25.4
  - kube-apiserver v1.24.8
  - kube-apiserver v1.23.14
  - kube-apiserver v1.22.16

This vulnerability was reported by Richard Turnbull of NCC Group as part of the Kubernetes Audit


**CVSS Rating:** Medium (6.5) [CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

    public static final String LABELS_LANG = "{labels.lang}";

    /** The key of the message: Outputs */
    public static final String LABELS_OUTPUTS = "{labels.outputs}";

    /** The key of the message: Part-of-speech */
    public static final String LABELS_POS = "{labels.pos}";

    /** The key of the message: Delete old job logs */
    public static final String LABELS_PURGE_JOB_LOG_DAY = "{labels.purgeJobLogDay}";

   * map are also in this queue, and that all elements not in the queue are not in the map.
   *
   * <p>The benefits of creating our own queue are that (1) we can replace elements in the middle of
   * the queue as part of copyWriteEntry, and (2) the contains method is highly optimized for the
   * current model.
   */
  static final class WriteQueue<K, V> extends AbstractQueue<ReferenceEntry<K, V>> {
    final ReferenceEntry<K, V> head =

		b.WriteString("abc")
		tw.check(t, "", "")
		b.WriteString("123456789012345")      // long string, non-empty buffer
		tw.check(t, "abc12345", "6789012345") // use Write and then WriteString since the remaining part is still longer than BufSize
	}
	{
		tw := &teststringwriter{}
		b := NewWriterSize(tw, BufSize)
		b.Write([]byte("abc")) // same as above, but use Write instead of WriteString
		tw.check(t, "", "")

## Urgent Upgrade Notes
### (No, really, you MUST read this before you upgrade)
#### Cluster Lifecycle
- Kubeadm: add a new `kubelet-finalize` phase as part of the `init` workflow and an experimental sub-phase to enable automatic kubelet client certificate rotation on primary control-plane nodes.

- The `system:aws-cloud-provider` cluster role, deprecated in v1.13, is no longer auto-created. Deployments using the AWS cloud provider should grant required permissions to the `aws-cloud-provider` service account in the `kube-system` namespace as part of deployment.  ([#66635](https://github.com/kubernetes/kubernetes/pull/66635), [@wgliang](https://github.com/wgliang))

#### Azure

     * entries.
     * <p>
     * The wildcard expression may consist of two special meta
     * characters in addition to the normal filename characters. The '*'
     * character matches any number of characters in part of a name. If
     * the expression begins with one or more '?'s then exactly that
     * many characters will be matched whereas if it ends with '?'s
     * it will match that many characters <i>or less</i>.
     * <p>

it just at first, the two creatures got so close to her, one on
each side, and opened their eyes and mouths so VERY wide, but she
gained courage as she went on.  Her listeners were perfectly
quiet till she got to the part about her repeating `YOU ARE OLD,
FATHER WILLIAM,' to the Caterpillar, and the words all coming
different, and then the Mock Turtle drew a long breath, and said
`That's very curious.'

* Introducing ScheduledJobs as described in [the proposal](docs/proposals/scheduledjob.md) as part of `batch/v2alpha1` version (experimental feature). ([#24970](https://github.com/kubernetes/kubernetes/pull/24970), [@soltysh](https://github.com/soltysh))

* Third Party Resource tests in the e2e suite were incorrectly marked as part of the conformance bucket.  They are alpha and are not required for conformance. ([#52823](https://github.com/kubernetes/kubernetes/pull/52823), [@smarterclayton](https://github.com/smarterclayton))