[Debian] CVE: CVE-2023-0767: nss: result in execution of arbitrary code

[Yue Tao]

CVE-2023-0767: https://nvd.nist.gov/vuln/detail/CVE-2023-0767

Base Score: High (refer to https://www.tenable.com/plugins/nessus/171623)

Christian Holler discovered that incorrect handling of PKCS 12 Safe Bag attributes in nss, the Mozilla Network Security Service library, may result in execution of arbitrary code if a specially crafted PKCS 12 certificate bundle is processed.

 References:

https://www.debian.org/security/2023/dsa-5353

['libnss3_2:3.61-1+deb11u2_amd64.deb===>libnss3_3.61-1+deb11u3_amd64.deb']

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/tools/+/884670

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/starlingx/tools/+/884670
Committed: https://opendev.org/starlingx/tools/commit/da878560d7ca5780afe4ab1cc95c948112750314
Submitter: "Zuul (22348)"
Branch: master

commit da878560d7ca5780afe4ab1cc95c948112750314
Author: Haiqing Bai <email address hidden>
Date: Tue May 30 16:31:24 2023 +0800

    nss: fix CVE-2023-0767

    Upgrade libnss3 to 3.61-1+deb11u3
    Upgrade libnss3-dev to 3.61-1+deb11u3

    Refer to:
    https://security-tracker.debian.org/tracker/CVE-2023-0767

    Test Plan:
    Pass: downloader -b
    Pass: build-pkgs --clean
    Pass: build-image
    Pass: Jenkins Installation
    PASS: dpkg -l | grep libnss3
          ii libnss3:amd64 2:3.61-1+deb11u3

    Closes-Bug: 2020722

    Change-Id: I94d15864e00717fe1bb31864e993657b9f076237
    Signed-off-by: Haiqing Bai <email address hidden>