# New vulnerability CVE-2023-5678 in OpenSSL version 1.1.1q

**URL:** <https://discuss.zetetic.net/t/new-vulnerability-cve-2023-5678-in-openssl-version-1-1-1q/6255>\
**Category:** Issues\
**Created:** [February 6, 2024, 8:40am UTC](https://discuss.zetetic.net/t/new-vulnerability-cve-2023-5678-in-openssl-version-1-1-1q/6255 "2024-02-06T08:40:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![shiva.hw](https://avatars.discourse-cdn.com/v4/letter/s/8491ac/32.png) [@shiva.hw](https://discuss.zetetic.net/u/shiva.hw)\
**Post date:** [February 6, 2024, 8:40am UTC](https://discuss.zetetic.net/t/new-vulnerability-cve-2023-5678-in-openssl-version-1-1-1q/6255/1 "2024-02-06T08:40:25Z")

</div>

New vulnerability CVE-2023-5678 in OpenSSL version 1.1.1q,

We are using following packages in our android application.

‘net.zetetic:android-database-sqlcipher:4.5.4@aar’  
‘net.zetetic:android-database-sqlcipher:4.5.3@aar’  
‘net.zetetic:android-database-sqlcipher:4.5.2@aar’

Does CVE-2023-5678 affect our application?

---

<div class="post-metadata">

**Author:** ![sjlombardo](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/sjlombardo/32/3_2.png) [@sjlombardo](https://discuss.zetetic.net/u/sjlombardo)\
**Post date:** [February 6, 2024, 1:46pm UTC](https://discuss.zetetic.net/t/new-vulnerability-cve-2023-5678-in-openssl-version-1-1-1q/6255/2 "2024-02-06T13:46:23Z")

</div>

@shiva.hw SQLCipher does not use DH, so it is not affected by CVE-2023-5678.

Even so, our recommendation would be to upgrade to SQLCipher 4.5.6 which is based on SQLite 3.44.2.

We are no longer releasing pre-built community edition packages of the legacy `android-database-sqlcipher` package, so if you are using community edition we recommend migrating to `sqlcipher-android` ([integration instructions](https://www.zetetic.net/sqlcipher/sqlcipher-for-android/), [github](https://github.com/sqlcipher/sqlcipher-android), [migration guide](https://www.zetetic.net/sqlcipher/sqlcipher-for-android-migration/)).

If you are using a commercially licensed android-database-sqlcipher package you may contact us separately at [support@zetetic.net](mailto:support@zetetic.net) to discuss further.

---

<div class="post-metadata">

**Author:** ![shiva.hw](https://avatars.discourse-cdn.com/v4/letter/s/8491ac/32.png) [@shiva.hw](https://discuss.zetetic.net/u/shiva.hw)\
**Post date:** [March 21, 2024, 9:58am UTC](https://discuss.zetetic.net/t/new-vulnerability-cve-2023-5678-in-openssl-version-1-1-1q/6255/3 "2024-03-21T09:58:22Z")

</div>

> [@sjlombardo](#):
>
> grade to SQLCipher

is this applicable for Android app

---

<div class="post-metadata">

**Author:** ![sjlombardo](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/sjlombardo/32/3_2.png) [@sjlombardo](https://discuss.zetetic.net/u/sjlombardo)\
**Post date:** [March 25, 2024, 2:38pm UTC](https://discuss.zetetic.net/t/new-vulnerability-cve-2023-5678-in-openssl-version-1-1-1q/6255/4 "2024-03-25T14:38:30Z")

</div>

Yes, this is applicable to Android