New vulnerabilities in openssl

SQLCipher
1

Hi
Our scan tool reports vulnerabilities CVE-2023-3446,CVE-2024-2511,CVE-2024-4741,CVE-2024-5535 in openssl 1.1.1s used by sqlcipher
Does these vulnerabilities affect net. zetetic:android-database-sqlcipher ?

Thanks

2

Hi @chen_song,

SQLCipher is not affected by CVE-2023-3446, CVE-2024-2511, or CVE-2024-5535 as it does not utilize Diffie–Hellman key exchange, nor TLS. I do not see any information currently available for CVE-2024-4741 [1] [2].

  1. NVD - CVE-2024-4741 ↩︎

  2. CVE - CVE-2024-4741 ↩︎

3

Hi @developernotes, thank you for your reply.
Detail about vunerability CVE-2024-4741 can be referenced from here:
https://www.openssl.org/news/vulnerabilities.html

4

@chen_song - SQLCipher is not affected by CVE-2024-4741 as it does not use SSL_free_buffers.