Marked for autoremoval on 28 December due to uwsgi: #938766high
Version 1:13.0.0-3 of heat is marked for autoremoval from testing on Sat 28 Dec 2019. It depends (transitively) on uwsgi, affected by #938766. You should try to prevent the removal by fixing these RC bugs.
Depends on packages which need a new maintainer
normal
The packages that heat depends on which need a new maintainer are:
CVE-2016-9185: In OpenStack Heat, by launching a new Heat stack with a local URL an authenticated user may conduct network discovery revealing internal network configuration. Affected versions are <=5.0.3, >=6.0.0 <=6.1.0, and ==7.0.0.
CVE-2015-5295: The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of service (memory consumption) or determine the existence of local files via the resource type in a template, as demonstrated by file:///dev/zero.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/h/heat.png){kind=link}