[Debian] High CVE: CVE-2022-48624/CVE-2024-32487 less : multiple CVEs

[Yue Tao]

CVE-2022-48624: https://nvd.nist.gov/vuln/detail/CVE-2022-48624

close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE.

CVE-2024-32487: https://nvd.nist.gov/vuln/detail/CVE-2024-32487

less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.

Base Score: High

Reference:

['less_551-2_amd64.deb===>less_551-2+deb11u2_amd64.deb']
https://security-tracker.debian.org/tracker/DSA-5679-1

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/tools/+/918958

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/starlingx/tools/+/918958
Committed: https://opendev.org/starlingx/tools/commit/8b7b4e4cd8a73dc27d48a33b7bddde13a22cec7d
Submitter: "Zuul (22348)"
Branch: master

commit 8b7b4e4cd8a73dc27d48a33b7bddde13a22cec7d
Author: STX Builder <email address hidden>
Date: Tue May 7 05:43:46 2024 +0000

    Debian: less : fix CVE-2022-48624/CVE-2024-32487

    Upgrade less to 551-2+deb11u2

    Refer to:
    https://security-tracker.debian.org/tracker/DSA-5679-1
    https://nvd.nist.gov/vuln/detail/CVE-2022-48624
    https://nvd.nist.gov/vuln/detail/CVE-2024-32487

    Test Plan:
    Pass: downloader
    Pass: build-pkgs --clean --all
    Pass: build-image
    Pass: boot

    Closes-bug: #2064863

    Change-Id: Ie5da9ebad90ffc218d59083276b9f25d1bad8e6c
    Signed-off-by: Wentao Zhang <email address hidden>