While auditing the Bitcoin Core RPC code I found an issue in UniValue. `UniValue::read()` in UniValue 1.0.3 and 1.0.4 allows a segfault via high object depth JSON.

Live demo:

```
$ src/bitcoind -regtest -rpcuser=u -rpcpassword=p > /dev/null &
[1] 8625
$ curl -u u:p --request POST \
      --data $(python -c 'print(50000 * "[");') http://127.0.0.1:18443
curl: (52) Empty reply from server
[1]+  Segmentation fault      (core dumped) src/bitcoind -regtest -rpcuser=u -rpcpassword=p > /dev/null
```

I reported the issue to `security@` and UniValue author @jgarzik back in early November 2019. The issue was fixed in commit https://github.com/jgarzik/univalue/commit/fe2227d4ace9d4d5b30710684c9d3b1012e3c0fc (https://github.com/jgarzik/univalue/pull/64). The issue in UniValue has been assigned CVE-2019-18936.

We need to bump our UniValue version to address this issue :)

CVE details submitted to MITRE by @jgarzik:

* Suggested description: `UniValue::read()` in UniValue 1.0.3 and 1.0.4 allows a segfault via malformed JSON.
* Additional Information: UniValue is a JSON I/O library commonly used in cryptocurrency applications.
* VulnerabilityType Other: Denial of Service
* Vendor of Product: univalue
* Affected Product Code Base: univalue - 1.0.4, univalue - 1.0.3
* Affected Component: `UniValue::read()` method
* Attack Type: Context-dependent
* Impact Denial of Service: true
* Attack Vectors: Supply malformed JSON into UniValue's JSON parser.
* Reference: https://github.com/jgarzik/univalue
* Has vendor confirmed or acknowledged the vulnerability?: true
* Discoverer: practicalswift
* Reference: https://github.com/jgarzik/univalue/compare/v1.0.4...v1.0.5, https://github.com/jgarzik/univalue/pull/58
case JTOK_KW_NULL:
                
                break;
            case JTOK_KW_TRUE:
                tmpVal.setBool(true);
                break;
            case JTOK_KW_FALSE:
                tmpVal.setBool(false);
                break;
            default:  break;
            }
            if (!stack.size()) {
                *this = tmpVal;
                break;
            }
            UniValue *top = stack.back();
            top->values.push_back(tmpVal);
            setExpect(NOT_VALUE);
            break;
            }
        case JTOK_NUMBER: {
            UniValue tmpVal(VNUM, tokenVal);
            if (!stack.size()) {
                *this = tmpVal;
                break;
            }
            UniValue *top = stack.back();
            top->values.push_back(tmpVal);
            setExpect(NOT_VALUE);
            break;