#1034243 unblock: heat/19.0.0-2 (fix for CVE-2023-1625 / #1034186)

#1034243#5
Date:
2023-04-11 08:58:46 UTC
From:
To:
Please unblock package heat

[ Reason ]
This last upload fixes CVE-2023-1625 / #1034186 (information leak in the
Heat API).

[ Impact ]
Before this patch, "openstack stack show" shows parameters that
are supposed to be hidden, like for example passwords (see the
launchpad entry https://launchpad.net/bugs/1999665 that is rather
explicit).

[ Tests ]
Building the package and the Debian CI contains upstream unit tests.
Also, the patch comes directly from upstream that runs functional
tests in their CI, which makes me confident nothing broke with this
patch. See test results at:
https://review.opendev.org/c/openstack/heat/+/873465

[ Risks ]
Not much risks as the patch only affects "stack show".

[ Checklist ]
  [x] all changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in testing

Cheers,

Thomas Goirand (zigo)

unblock heat/19.0.0-2

#1034243#10
Date:
2023-04-11 21:04:26 UTC
From:
To:
Unblocked.