Vulnerability in openssl-1.1.1q CVE-2023-5678

sqlcipher / android-database-sqlcipher

Android SQLite API based on SQLCipher

https://www.zetetic.net/sqlcipher/sqlcipher-for-android/

Other

2.73k stars 564 forks source link

Vulnerability in openssl-1.1.1q CVE-2023-5678 #638

Closed lyh-ADT closed 6 months ago

lyh-ADT commented 6 months ago

Our internal tool reported that there are some Vulnerabilities in openssl-1.1.1.q And android-database-sqlcipher version is 4.5.2

CVE-2023-5678

It seems like dealing with long X9.42 DH keys will cause this CVE. Is SQLcipher affected by this? Will the new version fix these issues? Or when will they be fixed?

sjlombardo commented 6 months ago

SQLCipher does not use DH, and is unaffected. You should also upgrade to 4.5.5 which is the latest release.