[Debian] CVE: CVE-2021-46848: libtasn1 : an ETYPE_OK off-by-one

[Yue Tao]

CVE-2021-46848: https://nvd.nist.gov/vuln/detail/CVE-2021-46848

GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.

Score:
cve_id status cvss3Score av ac pr ui ai
CVE-2022-42898 fixed 9.1 N L N N H

References:
https://security-tracker.debian.org/tracker/CVE-2021-46848

['libtasn1-6_4.16.0-2_amd64.deb===>libtasn1-6_4.16.0-2+deb11u1_amd64.deb']

Found during December 2022 CVE scan using vulscan

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/tools/+/869625

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/starlingx/tools/+/869625
Committed: https://opendev.org/starlingx/tools/commit/e9da987a141f1568b5db198acf4bae269a56d6c5
Submitter: "Zuul (22348)"
Branch: master

commit e9da987a141f1568b5db198acf4bae269a56d6c5
Author: Zhixiong Chi <email address hidden>
Date: Mon Jan 9 00:20:19 2023 -0800

    Debian: libtasn1-6: CVE-2021-46848

    Upgrade libtasn1-6 to 4.16.0-2+deb11u1 to fix CVE-2021-46848.
    libtasn1-6_4.16.0-2+deb11u1

    Refer to:
    https://security-tracker.debian.org/tracker/CVE-2021-46848

    TestPlan:
    PASS: downloader
    PASS: build-pkgs -a -c
    PASS: build-image
    PASS: Jenkins Installation.

    Closes-Bug: 2002279

    Signed-off-by: Zhixiong Chi <email address hidden>
    Change-Id: I8ff6d581b06b4f035f53fc01f5349afb5097a9c8