Debian Patches

Status for heat/1:27.0.0-5

Patch Description Author Forwarded Bugs Origin Last update
remove-broken-rst.patch Remove broken RST In hot_spec.rst, there's some lines that are FTBFS with the newer docutils.
Since it doesn't seem that important, and it's best to keep the rest of the
documentation, we're just removing the block.

===================================================================		 Thomas Goirand <zigo@debian.org> no debian 2017-01-08
package-all-files.patch Package all files Thomas Goirand <zigo@debian.org> no 2017-12-15
add-heat_api_root-configuration-variable.patch Add heat_api_root configuration variable
===================================================================		 Thomas Goirand <zigo@debian.org> yes 2021-10-07
sb-2011933_Enforce_stack-user_binding_on_resource_signal.patch Enforce stack-user binding on resource_signal EngineService.resource_signal() executes signals under the stack's stored
owner context but never verified that the requesting stack user is bound to
the resource being signalled. describe_stack_resource() enforces that
binding through _authorize_stack_user(), and the metadata read path is
bound the same way, so a holder of any stack-user credential (for example,
one recovered from the user data of a snapshot or image of a Heat-managed
server) could signal any resource of any stack in the credential's
project, forging deployment output values that heat consumes in
owner-driven stack updates.
.
Apply the same _authorize_stack_user() binding to resource_signal().
Signals authenticated with ec2 credentials (the CFN API path) keep working
through the existing _authorize_stack_user() fallback, and signals from
contexts without the stack-user role are unaffected.

diff --git a/heat/engine/service.py b/heat/engine/service.py
index fe017eeee..afe1ab4fe 100644		 Thomas Goirand <zigo@debian.org> yes debian 2026-11-12

All known versions for source package 'heat'

Links