[Debian] High CVE: CVE-2022-48554 file: an stack-based buffer over-read

[Yue Tao]

CVE-2022-48554: https://nvd.nist.gov/vuln/detail/CVE-2022-48554

File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project.

Base Score: High

Reference:

['file_1:5.39-3_amd64.deb===>file_1:5.39-3+deb11u1_amd64.deb', 'libmagic1_1:5.39-3_amd64.deb===>libmagic1_1:5.39-3+deb11u1_amd64.deb', 'libmagic-mgc_1:5.39-3_amd64.deb===>libmagic-mgc_1:5.39-3+deb11u1_amd64.deb']
https://www.debian.org/security/2023/dsa-5489

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/tools/+/895244

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/starlingx/tools/+/895244
Committed: https://opendev.org/starlingx/tools/commit/54c986fcea0dce5a57aba0254ea183fa898bf7be
Submitter: "Zuul (22348)"
Branch: master

commit 54c986fcea0dce5a57aba0254ea183fa898bf7be
Author: Wentao Zhang <email address hidden>
Date: Fri Sep 15 10:31:45 2023 +0800

    Debian: package : fix CVE-2022-48554

    Upgrade file to 1:5.39-3+deb11u1
    Upgrade libmagic1 to 1:5.39-3+deb11u1
    Upgrade libmagic-mgc to 1:5.39-3+deb11u1

    Refer to:
    https://nvd.nist.gov/vuln/detail/CVE-2022-48554

    Test Plan:
    Pass: downloader
    Pass: build-pkgs --clean --all
    Pass: build-image
    Pass: boot

    Closes-bug: #2034117

    Change-Id: Ib042ddef6c5a0389224b8ddc6826b5177c0de1f4
    Signed-off-by: Wentao Zhang <email address hidden>