[Debian] Critical CVE: CVE-2021-32292 json-c: a stack-buffer-overflow

[Yue Tao]

CVE-2021-32292: https://nvd.nist.gov/vuln/detail/CVE-2021-32292

An issue was discovered in json-c through 0.15-20200726. A stack-buffer-overflow exists in the function parseit located in json_parse.c. It allows an attacker to cause code Execution.

Base Score: Critical

Reference:

['libjson-c5_0.15-2_amd64.deb===>libjson-c5_0.15-2+deb11u1_amd64.deb']
https://www.debian.org/security/2023/dsa-5486

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/tools/+/895243

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/starlingx/tools/+/895243
Committed: https://opendev.org/starlingx/tools/commit/2af4185138df166f70b2c0f999bcfb41679f78b4
Submitter: "Zuul (22348)"
Branch: master

commit 2af4185138df166f70b2c0f999bcfb41679f78b4
Author: Wentao Zhang <email address hidden>
Date: Fri Sep 15 10:27:35 2023 +0800

    Debian: package : fix CVE-2021-32292

    Upgrade libjson-c5 to 0.15-2+deb11u1
    Upgrade libjson-c-dev to 0.15-2+deb11u1

    Refer to:
    https://nvd.nist.gov/vuln/detail/CVE-2021-32292

    Test Plan:
    Pass: downloader
    Pass: build-pkgs --clean --all
    Pass: build-image
    Pass: boot

    Closes-bug: #2033581

    Change-Id: I24d4e0b2c4c9c50b5e3b6fb0e22202ddda55d77d
    Signed-off-by: Wentao Zhang <email address hidden>