[Debian] High CVE: CVE-2023-34969 dbus: dbus-daemon crash under some circumstances

[Yue Tao]

CVE-2023-34969: https://nvd.nist.gov/vuln/detail/CVE-2023-34969

D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.

Base Score: High

Reference:

['dbus_1.12.24-0+deb11u1_amd64.deb===>dbus_1.12.28-0+deb11u1_amd64.deb', 'dbus-user-session_1.12.24-0+deb11u1_amd64.deb===>dbus-user-session_1.12.28-0+deb11u1_amd64.deb', 'libdbus-1-3_1.12.24-0+deb11u1_amd64.deb===>libdbus-1-3_1.12.28-0+deb11u1_amd64.deb', 'libdbus-1-dev_1.12.24-0+deb11u1_amd64.deb===>libdbus-1-dev_1.12.28-0+deb11u1_amd64.deb']

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/tools/+/899019

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/starlingx/tools/+/899019
Committed: https://opendev.org/starlingx/tools/commit/960b6d328eee35d203fdf3adcda744cf09e6a40f
Submitter: "Zuul (22348)"
Branch: master

commit 960b6d328eee35d203fdf3adcda744cf09e6a40f
Author: Haiqing Bai <email address hidden>
Date: Sun Oct 22 23:08:59 2023 -0700

    Debian: dbus: fix CVE-2023-34969

    Upgraded:
    dbus to dbus_1.12.28-0+deb11u1_amd64.deb
    dbus-user-session to dbus-user-session_1.12.28-0+deb11u1_amd64.deb
    libdbus-1 to libdbus-1-3_1.12.28-0+deb11u1_amd64.deb
    libdbus-1-dev to libdbus-1-dev_1.12.28-0+deb11u1_amd64.deb

    Refer to:
    https://security-tracker.debian.org/tracker/CVE-2023-34969

    Test Plan:
    Pass: downloader
    Pass: build-pkgs --clean --all
    Pass: build-image
    Pass: boot

    Closes-bug: #2038878

    Change-Id: I3d872ae08f8a97cbb5db17ddb0a4ab72125fe652
    Signed-off-by: Haiqing Bai <email address hidden>