# Magellan Vulnerbility **URL:** \ **Category:** SQLCipher\ **Created:** [December 15, 2018, 2:21am UTC](https://discuss.zetetic.net/t/magellan-vulnerbility/3290 "2018-12-15T02:21:09Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![ChadKillingsworth](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/chadkillingsworth/32/900_2.png) [@ChadKillingsworth](https://discuss.zetetic.net/u/ChadKillingsworth)\ **Post date:** [December 15, 2018, 2:21am UTC](https://discuss.zetetic.net/t/magellan-vulnerbility/3290/1 "2018-12-15T02:21:09Z")
Does the newly disclosed Magellan vulnerability affect SqlCipher versions? [https://www.zdnet.com/article/sqlite-bug-impacts-thousands-of-apps-including-all-chromium-based-browsers/](https://www.zdnet.com/article/sqlite-bug-impacts-thousands-of-apps-including-all-chromium-based-browsers/) ---
**Author:** ![justinclift](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/justinclift/32/89_2.png) [@justinclift](https://discuss.zetetic.net/u/justinclift)\ **Post date:** [December 15, 2018, 5:07am UTC](https://discuss.zetetic.net/t/magellan-vulnerbility/3290/2 "2018-12-15T05:07:15Z")
Interesting. Reading the Magellan release info page, there’s not a lot of info in it: [https://blade.tencent.com/magellan/index\_en.html](https://blade.tencent.com/magellan/index_en.html) It does mention SQLite 3.26.0 as being safe. Sounds like there will need to be an update of SQLCipher’s base to either include the appropriate patch, or just update it to 3.26.0 itself. ---
**Author:** ![justinclift](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/justinclift/32/89_2.png) [@justinclift](https://discuss.zetetic.net/u/justinclift)\ **Post date:** [December 15, 2018, 5:13am UTC](https://discuss.zetetic.net/t/magellan-vulnerbility/3290/3 "2018-12-15T05:13:06Z")
Seems to be more useful info here: - [https://news.ycombinator.com/item?id=18686305](https://news.ycombinator.com/item?id=18686305) - [https://news.ycombinator.com/item?id=18686462](https://news.ycombinator.com/item?id=18686462) (response to the above, by the main SQLite author) Proof of concept exploit showing the crash: - [https://worthdoingbadly.com/sqlitebug/](https://worthdoingbadly.com/sqlitebug/) - [https://github.com/zhuowei/worthdoingbadly.com/blob/8708d93eaa0891f167812cea9235306a24820bd1/\_posts/2018-12-14-sqlitebug.html#L59-L136](https://github.com/zhuowei/worthdoingbadly.com/blob/8708d93eaa0891f167812cea9235306a24820bd1/_posts/2018-12-14-sqlitebug.html#L59-L136) It mentions the SQLite source code patch which fixes the vulnerability: - [https://www.sqlite.org/src/info/940f2adc8541a838](https://www.sqlite.org/src/info/940f2adc8541a838) To me, it looks like the bug is in the FTS3 module. So if your SQLCipher is compiled without FTS3, it’s probably “safe” as is. The patch itself looks fairly simple. It may be easy to update SQLCipher to include just that. No idea personally, as security related stuff can sometimes take a fair while to re-validate even after a “minor” change. 🙂 ---
**Author:** ![ChadKillingsworth](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/chadkillingsworth/32/900_2.png) [@ChadKillingsworth](https://discuss.zetetic.net/u/ChadKillingsworth)\ **Post date:** [December 15, 2018, 5:31pm UTC](https://discuss.zetetic.net/t/magellan-vulnerbility/3290/4 "2018-12-15T17:31:27Z")
That’s great information - and makes me feel a bit better. Since we control all of the SQL that gets executed, that definitely makes things a bit better. But yes - we anxiously await a new version of SqlCipher. ---
**Author:** ![brodybits](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/brodybits/32/515_2.png) [@brodybits](https://discuss.zetetic.net/u/brodybits)\ **Post date:** [December 16, 2018, 5:02pm UTC](https://discuss.zetetic.net/t/magellan-vulnerbility/3290/5 "2018-12-16T17:02:34Z")
FYI it should be possible for any developer to update SQLCipher to SQLite 3.26.0 as described in [https://discuss.zetetic.net/t/sqlcipher-sqlite-update/2470](https://discuss.zetetic.net/t/sqlcipher-sqlite-update/2470). I hope to see this update on SQLCipher ASAP. While a patch on FTS3 should be good enough I would really favor a clean SQLite 3.26.0 update. Someone also raised a GitHub issue in [https://github.com/sqlcipher/sqlcipher/issues/297](https://github.com/sqlcipher/sqlcipher/issues/297). I _think_ this is the right place to discuss the wanted update but am not 100% sure. ---
**Author:** ![sjlombardo](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/sjlombardo/32/3_2.png) [@sjlombardo](https://discuss.zetetic.net/u/sjlombardo)\ **Post date:** [December 16, 2018, 8:58pm UTC](https://discuss.zetetic.net/t/magellan-vulnerbility/3290/6 "2018-12-16T20:58:53Z")
The latest SQLCipher 4.0.0 release is based on 3.25.2, so it is affected. However an update, SQLCipher 4.0.1 based on 3.26.0, should be available next week to resolve this. We’ve already updated the baseline, so we are just finishing up builds and testing. Keep an eye out for the release notification here. ---
**Author:** ![brodybits](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/brodybits/32/515_2.png) [@brodybits](https://discuss.zetetic.net/u/brodybits)\ **Post date:** [December 16, 2018, 10:00pm UTC](https://discuss.zetetic.net/t/magellan-vulnerbility/3290/7 "2018-12-16T22:00:29Z")
Thanks @sjlombardo for the quick response! ---
**Author:** ![sjlombardo](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/sjlombardo/32/3_2.png) [@sjlombardo](https://discuss.zetetic.net/u/sjlombardo)\ **Post date:** [December 18, 2018, 10:06pm UTC](https://discuss.zetetic.net/t/magellan-vulnerbility/3290/8 "2018-12-18T22:06:43Z")
We’ve just released [SQLCipher 4.0.1](https://www.zetetic.net/blog/2018/12/18/sqlcipher-401-release/). The new version of SQLCipher is based on SQLite 3.26.0 so it addresses the Magellan vulnerability. In also includes new PRAGMAs to simplify backwards compatibility settings for applications (`PRAGMA cipher_compatibility/cipher_default_compatibility`), plus some other improvements and fixes.