瀏覽代碼

package/sox: ignore CVE-2023-34432

Commit [1] introduced a patch addressing CVE-2021-23159. Since then,
CVE-2023-34432 ([2]) remained the only unresolved CVE reported
against the sox package in pkg-stat.  This patch adds CVE-2023-34432
to the list of ignored CVEs for sox, based on the report from the
Debian Security Tracker ([3]) and the sox issue tracker ([4]), both
indicate that the patch introduced in [1] also resolves this CVE.

[1] 14aa0f5ec1 package/sox: add fix for CVE-2021-23159, CVE-2021-23172, CVE-2023-34318
[2] https://nvd.nist.gov/vuln/detail/CVE-2023-34432
[3] https://security-tracker.debian.org/tracker/CVE-2023-34432
[4] https://sourceforge.net/p/sox/bugs/367/

Signed-off-by: Tim Soubry <tim.soubry@mind.be>
[Julien: change commit ref [1] to use commit id from master branch]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e868b974a799073428b7565925507697e049df0a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Tim Soubry 1 月之前
父節點
當前提交
cebee82f62
共有 1 個文件被更改,包括 1 次插入1 次删除
  1. 1 1
      package/sox/sox.mk

+ 1 - 1
package/sox/sox.mk

@@ -67,7 +67,7 @@ SOX_IGNORE_CVES += CVE-2021-3643 CVE-2021-23210
 # 0007-hcom-validate-dictsize.patch
 # This entry is NOT stale, those CVEs are not reported by pkg-stats
 # due to the change of CPE ID to sox_project:sox in the NVD database
-SOX_IGNORE_CVES += CVE-2021-23159 CVE-2021-23172 CVE-2023-34318
+SOX_IGNORE_CVES += CVE-2021-23159 CVE-2021-23172 CVE-2023-34318 CVE-2023-34432
 
 # 0008-phere-avoid-integer-underflow.patch
 # This entry is NOT stale, those CVEs are not reported by pkg-stats