An update for kubernetes is now available for openEuler-24.03-LTS Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2025-2818 Final 1.0 1.0 2025-12-12 Initial 2025-12-12 2025-12-12 openEuler SA Tool V1.0 2025-12-12 kubernetes security update An update for kubernetes is now available for openEuler-24.03-LTS Container cluster management. Security Fix(es): A vulnerability was found in Kubernetes kube-controller-manager up to versions 1.30.14, 1.31.14, 1.32.9, 1.33.5 and 1.34.1. It has been classified as CWE-918 (Server-Side Request Forgery). The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This vulnerability impacts confidentiality, integrity, and availability.(CVE-2025-13281) An update for kubernetes is now available for openEuler-24.03-LTS. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium kubernetes https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2818 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-13281 https://nvd.nist.gov/vuln/detail/CVE-2025-13281 openEuler-24.03-LTS kubernetes-1.29.1-14.oe2403.aarch64.rpm kubernetes-client-1.29.1-14.oe2403.aarch64.rpm kubernetes-help-1.29.1-14.oe2403.aarch64.rpm kubernetes-kubeadm-1.29.1-14.oe2403.aarch64.rpm kubernetes-kubelet-1.29.1-14.oe2403.aarch64.rpm kubernetes-master-1.29.1-14.oe2403.aarch64.rpm kubernetes-node-1.29.1-14.oe2403.aarch64.rpm kubernetes-1.29.1-14.oe2403.src.rpm kubernetes-1.29.1-14.oe2403.x86_64.rpm kubernetes-client-1.29.1-14.oe2403.x86_64.rpm kubernetes-help-1.29.1-14.oe2403.x86_64.rpm kubernetes-kubeadm-1.29.1-14.oe2403.x86_64.rpm kubernetes-kubelet-1.29.1-14.oe2403.x86_64.rpm kubernetes-master-1.29.1-14.oe2403.x86_64.rpm kubernetes-node-1.29.1-14.oe2403.x86_64.rpm A vulnerability was found in Kubernetes kube-controller-manager up to versions 1.30.14, 1.31.14, 1.32.9, 1.33.5 and 1.34.1. It has been classified as CWE-918 (Server-Side Request Forgery). The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This vulnerability impacts confidentiality, integrity, and availability. 2025-12-12 CVE-2025-13281 openEuler-24.03-LTS Medium 5.8 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N kubernetes security update 2025-12-12 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2818