From cebee82f6222be090592b2d877641ca8470ce631 Mon Sep 17 00:00:00 2001 From: Tim Soubry Date: Thu, 3 Jul 2025 10:39:18 +0200 Subject: [PATCH] package/sox: ignore CVE-2023-34432 Commit [1] introduced a patch addressing CVE-2021-23159. Since then, CVE-2023-34432 ([2]) remained the only unresolved CVE reported against the sox package in pkg-stat. This patch adds CVE-2023-34432 to the list of ignored CVEs for sox, based on the report from the Debian Security Tracker ([3]) and the sox issue tracker ([4]), both indicate that the patch introduced in [1] also resolves this CVE. [1] 14aa0f5ec1 package/sox: add fix for CVE-2021-23159, CVE-2021-23172, CVE-2023-34318 [2] https://nvd.nist.gov/vuln/detail/CVE-2023-34432 [3] https://security-tracker.debian.org/tracker/CVE-2023-34432 [4] https://sourceforge.net/p/sox/bugs/367/ Signed-off-by: Tim Soubry [Julien: change commit ref [1] to use commit id from master branch] Signed-off-by: Julien Olivain (cherry picked from commit e868b974a799073428b7565925507697e049df0a) Signed-off-by: Thomas Perale --- package/sox/sox.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package/sox/sox.mk b/package/sox/sox.mk index 3c9c939e8c..9fd3f2151c 100644 --- a/package/sox/sox.mk +++ b/package/sox/sox.mk @@ -67,7 +67,7 @@ SOX_IGNORE_CVES += CVE-2021-3643 CVE-2021-23210 # 0007-hcom-validate-dictsize.patch # This entry is NOT stale, those CVEs are not reported by pkg-stats # due to the change of CPE ID to sox_project:sox in the NVD database -SOX_IGNORE_CVES += CVE-2021-23159 CVE-2021-23172 CVE-2023-34318 +SOX_IGNORE_CVES += CVE-2021-23159 CVE-2021-23172 CVE-2023-34318 CVE-2023-34432 # 0008-phere-avoid-integer-underflow.patch # This entry is NOT stale, those CVEs are not reported by pkg-stats