# New vulnerabilities detected in library OpenSSL version 1.1.1q

**URL:** <https://discuss.zetetic.net/t/new-vulnerabilities-detected-in-library-openssl-version-1-1-1q/6156>\
**Category:** SQLCipher\
**Created:** [November 10, 2023, 4:33pm UTC](https://discuss.zetetic.net/t/new-vulnerabilities-detected-in-library-openssl-version-1-1-1q/6156 "2023-11-10T16:33:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![shiva.hw](https://avatars.discourse-cdn.com/v4/letter/s/8491ac/32.png) [@shiva.hw](https://discuss.zetetic.net/u/shiva.hw)\
**Post date:** [November 10, 2023, 4:33pm UTC](https://discuss.zetetic.net/t/new-vulnerabilities-detected-in-library-openssl-version-1-1-1q/6156/1 "2023-11-10T16:33:26Z")

</div>

Our scan tool reports vulnerabilities BDSA-2023-3046 in openssl 1.1.1q used by SQLCipher.  
Does these vulnerabilities affect the library net.zetetic:android-database-sqlcipher?

Thanks,  
Shiva G P

---

<div class="post-metadata">

**Author:** ![developernotes](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/developernotes/32/1309_2.png) [@developernotes](https://discuss.zetetic.net/u/developernotes)\
**Post date:** [November 10, 2023, 6:22pm UTC](https://discuss.zetetic.net/t/new-vulnerabilities-detected-in-library-openssl-version-1-1-1q/6156/2 "2023-11-10T18:22:57Z")

</div>

Hi @shiva.hw,

Thank you for reaching out regarding SQLCipher. Unfortunately, I was unable to locate a public reference to BDSA-2023-3046. Is that something you can provide, or is there a corresponding public CVE that has been issued? Additionally, can you clarify whether your organization is utilizing a Community/Commercial/Enterprise build of SQLCipher for Android?

---

<div class="post-metadata">

**Author:** ![shiva.hw](https://avatars.discourse-cdn.com/v4/letter/s/8491ac/32.png) [@shiva.hw](https://discuss.zetetic.net/u/shiva.hw)\
**Post date:** [November 11, 2023, 2:16am UTC](https://discuss.zetetic.net/t/new-vulnerabilities-detected-in-library-openssl-version-1-1-1q/6156/3 "2023-11-11T02:16:33Z")

</div>

> [@developernotes](#):
>
> BDSA-2023-3046

Hi @developernotes , Thanks for your quick response. I’m are using following dependency in my app  
“net.zetetic:android-database-sqlcipher:4.5.4@aar”

---

<div class="post-metadata">

**Author:** ![sjlombardo](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/sjlombardo/32/3_2.png) [@sjlombardo](https://discuss.zetetic.net/u/sjlombardo)\
**Post date:** [November 12, 2023, 2:34pm UTC](https://discuss.zetetic.net/t/new-vulnerabilities-detected-in-library-openssl-version-1-1-1q/6156/4 "2023-11-12T14:34:39Z")

</div>

@shiva.hw - android-database-sqlcipher is [now deprecated](https://www.zetetic.net/blog/2023/08/31/sqlcipher-4.5.5-release/#sqlcipher-android-455). You should consider [migrating](https://www.zetetic.net/sqlcipher/sqlcipher-for-android-migration/) over to use the replacement, [sqlcipher-android](https://www.zetetic.net/sqlcipher/sqlcipher-for-android/) with OpenSSL 3.0.10. Barring that we would need to know what the CVE identifier is to say whether SQLCipher would be impacted. However, SQLCipher is not affected by any of the published CVEs on the OpenSSL project.