# Regarding CVE-2021-4160

**URL:** <https://discuss.zetetic.net/t/regarding-cve-2021-4160/5297>\
**Category:** SQLCipher\
**Created:** [February 15, 2022, 5:49am UTC](https://discuss.zetetic.net/t/regarding-cve-2021-4160/5297 "2022-02-15T05:49:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![David\_Cui](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/david_cui/32/1762_2.png) [@David\_Cui](https://discuss.zetetic.net/u/David_Cui)\
**Post date:** [February 15, 2022, 5:49am UTC](https://discuss.zetetic.net/t/regarding-cve-2021-4160/5297/1 "2022-02-15T05:49:54Z")

</div>

Hi team,  
The vulnerability issue CVE-2021-4160 was discovered in **OpenSSL 1.1.1l** recently while OpenSSL 1.1.1l is the version the latest SQLCipher 4.5.0 is using as I know.  
Is the vulnerability issue CVE-2021-4160 false positive?  
Is there a plan for a new release with the fix (Fixed in OpenSSL 3.0.1 (Affected 3.0.0). Fixed in OpenSSL 1.1.1m (Affected 1.1.1-1.1.1l) as [NVD - CVE-2021-4160](https://nvd.nist.gov/vuln/detail/CVE-2021-4160) pointed out)?

Thanks,

Best Regards,  
David

---

<div class="post-metadata">

**Author:** ![sjlombardo](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/sjlombardo/32/3_2.png) [@sjlombardo](https://discuss.zetetic.net/u/sjlombardo)\
**Post date:** [February 15, 2022, 1:10pm UTC](https://discuss.zetetic.net/t/regarding-cve-2021-4160/5297/2 "2022-02-15T13:10:04Z")

</div>

Hello @David_Cui - SQLCipher is not affected by [CVE-2021-4160](https://nvd.nist.gov/vuln/detail/CVE-2021-4160) because it doesn’t use EC algorithms. Furthermore, the bug is related to MIPS architectures, and we do not provide prebuilt libraries for that architecture (though it is technically possible to compile them yourself). That said the next release of SQLCipher, which should be forthcoming, will use OpenSSL 1.1.1m by default.

---

<div class="post-metadata">

**Author:** ![David\_Cui](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/david_cui/32/1762_2.png) [@David\_Cui](https://discuss.zetetic.net/u/David_Cui)\
**Post date:** [February 16, 2022, 3:59am UTC](https://discuss.zetetic.net/t/regarding-cve-2021-4160/5297/3 "2022-02-16T03:59:51Z")

</div>

Hello @ sjlombardo - got it. Thanks for your prompt feedback. You have a good day!