Bug#944099: CVE-2019-14433 / OSSA-2019-003: buster-pu: package nova/2:18.1.0-6 -> 18.1.0-6+deb10u1

[Julien Cristau <jcristau@debian.org>]

On Sun, Nov 24, 2019 at 10:06:51AM +0100, Thomas Goirand wrote:
> On 11/23/19 6:09 PM, Julien Cristau wrote:
> > Control: tag -1 moreinfo
> > 
> > On Mon, Nov 04, 2019 at 11:53:52AM +0100, Thomas Goirand wrote:
> >> We would like to update Nova in Buster for 2 reasons. First, there's
> >> OSSA-2019-003 / CVE-2019-14433 which we would like to fix. Second,
> >> in non-interactive mode, upgrading Nova can lead to some configuration
> >> changes, which is an RC bug.
> >>
> > This doesn't sound like it should require new debconf templates.  What's
> > the logic there?  Why does upgrading touch the configuration at all?
> > 
> > Cheers,
> > Julien
> 
> Same as for Heat for which I just replied.
> 
> In the postinst, after consuming the password prompt in the .config
> script, the password is forgotten using db_unregister. The only way to
> avoid this is to have this other screen prompting for not handling this
> through debconf, which is always the default.
> 
This still doesn't make sense to me.

Cheers,
Julien