[Debian] Medium CVE: CVE-2023-48733 edk2 OS-resident attacker to bypass Secure Boot

[Yue Tao]

CVE-2023-48733: https://nvd.nist.gov/vuln/detail/CVE-2023-48733

An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot.

Base Score: Medium

Reference:

['ovmf_2020.11-2+deb11u1_all.deb===>ovmf_2020.11-2+deb11u2_all.deb']
https://security-tracker.debian.org/tracker/DSA-5624-1

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/tools/+/910127

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/starlingx/tools/+/910127
Committed: https://opendev.org/starlingx/tools/commit/a36a1ee862a19a16931abbd03461b1c83c649230
Submitter: "Zuul (22348)"
Branch: master

commit a36a1ee862a19a16931abbd03461b1c83c649230
Author: Peng Zhang <email address hidden>
Date: Wed Feb 21 05:56:42 2024 +0000

    ovmf: Upgrade to ovmf_2020.11-2+deb11u2_all.deb

    Upgrade package ovmf from 2020.11-2+deb11u1 to 2020.11-2+deb11u2 in
    order to fixing the CVE issue CVE-2023-48733.

    Refer to:
    https://nvd.nist.gov/vuln/detail/CVE-2023-48733
    https://security-tracker.debian.org/tracker/DSA-5624-1

    TestPlan:
    PASS: downloader; build-pkgs; build-image
    PASS: Jenkins Installation

    Closes-Bug: 2054273

    Change-Id: I42937791da7c25b59ae4cf2f945bdd4b6d57ade3
    Signed-off-by: Peng Zhang <email address hidden>