# Sqlcipher:4.5.4v contains which version of openssl? **URL:** \ **Category:** SQLCipher\ **Created:** [August 1, 2023, 7:41am UTC](https://discuss.zetetic.net/t/sqlcipher-4-5-4v-contains-which-version-of-openssl/6029 "2023-08-01T07:41:17Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Abu\_Basith](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/abu_basith/32/2049_2.png) [@Abu\_Basith](https://discuss.zetetic.net/u/Abu_Basith)\ **Post date:** [August 1, 2023, 7:41am UTC](https://discuss.zetetic.net/t/sqlcipher-4-5-4v-contains-which-version-of-openssl/6029/1 "2023-08-01T07:41:17Z")
I am using the below package verion in my project. **implementation ‘net.zetetic:android-database-sqlcipher:4.5.4@aar’** **implementation ‘androidx.sqlite:sqlite:2.2.0’** before I used the sqlcipher:4.0.1@aar` but our security team reported an issue of the package being outdated. **issues: `openssl` version `1.1.1** Could you please confirm to us which version of OpenSSL version is used in **SqlChiper:4.5.4v**? ---
**Author:** ![sjlombardo](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/sjlombardo/32/3_2.png) [@sjlombardo](https://discuss.zetetic.net/u/sjlombardo)\ **Post date:** [August 1, 2023, 1:30pm UTC](https://discuss.zetetic.net/t/sqlcipher-4-5-4v-contains-which-version-of-openssl/6029/2 "2023-08-01T13:30:06Z")
From the release [announcement](https://www.zetetic.net/blog/2023/04/27/sqlcipher-4.5.4-release/): > non-FIPS packages using OpenSSL now include 1.1.1t, except Windows UAP which uses OpenSSL 1.1.1s ---
**Author:** ![Abu\_Basith](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/abu_basith/32/2049_2.png) [@Abu\_Basith](https://discuss.zetetic.net/u/Abu_Basith)\ **Post date:** [August 2, 2023, 4:46pm UTC](https://discuss.zetetic.net/t/sqlcipher-4-5-4v-contains-which-version-of-openssl/6029/3 "2023-08-02T16:46:17Z")
we got feedback from the security team, **Android: Vuln 9. Partially Fixed, Dependency openssl version 1.1.1t was detected at lib/armeabi-v7a/libsqlcipher.so and lib/arm64-v8a/libsqlcipher.so** Is any way to update the OpenSSL version? @sjlombardo. Because the security team reported as it is outdated. ---
**Author:** ![sjlombardo](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/sjlombardo/32/3_2.png) [@sjlombardo](https://discuss.zetetic.net/u/sjlombardo)\ **Post date:** [August 2, 2023, 9:01pm UTC](https://discuss.zetetic.net/t/sqlcipher-4-5-4v-contains-which-version-of-openssl/6029/4 "2023-08-02T21:01:38Z")
Hello @Abu_Basith - you could build SQLCipher yourself from source and use a different OpenSSL version. Otherwise, you’d need to wait for the next release when we would update the version used. ---
**Author:** ![Abu\_Basith](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/abu_basith/32/2049_2.png) [@Abu\_Basith](https://discuss.zetetic.net/u/Abu_Basith)\ **Post date:** [August 3, 2023, 7:31am UTC](https://discuss.zetetic.net/t/sqlcipher-4-5-4v-contains-which-version-of-openssl/6029/5 "2023-08-03T07:31:15Z")
Thanks @sjlombardo - Could you please give any guidance for the OpenSSL version update in SQLChiper? ---
**Author:** ![sjlombardo](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/sjlombardo/32/3_2.png) [@sjlombardo](https://discuss.zetetic.net/u/sjlombardo)\ **Post date:** [August 4, 2023, 8:00pm UTC](https://discuss.zetetic.net/t/sqlcipher-4-5-4v-contains-which-version-of-openssl/6029/6 "2023-08-04T20:00:23Z")
I can’t provide a concrete timeline right now, but there will likely be a release sometime this month. ---
**Author:** ![Abu\_Basith](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/abu_basith/32/2049_2.png) [@Abu\_Basith](https://discuss.zetetic.net/u/Abu_Basith)\ **Post date:** [September 12, 2023, 7:57am UTC](https://discuss.zetetic.net/t/sqlcipher-4-5-4v-contains-which-version-of-openssl/6029/7 "2023-09-12T07:57:19Z")
Hey @sjlombardo, I saw the new version 4.5.5v is officially released so is there an OpenSSL version increased? ---
**Author:** ![sjlombardo](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/sjlombardo/32/3_2.png) [@sjlombardo](https://discuss.zetetic.net/u/sjlombardo)\ **Post date:** [September 12, 2023, 5:57pm UTC](https://discuss.zetetic.net/t/sqlcipher-4-5-4v-contains-which-version-of-openssl/6029/8 "2023-09-12T17:57:55Z")
Hello @Abu_Basith - SQLCipher non-FIPS packages that use the OpenSSL Cryptographic Provider are now using OpenSSL 3.0.10 LTS. Note that android-database-sqlcipher has been [deprecated](https://www.zetetic.net/blog/2023/08/31/sqlcipher-4.5.5-release/#sqlcipher-android-455), so you should [migrate](https://www.zetetic.net/sqlcipher/sqlcipher-for-android-migration) to use the new [sqlcipher-android](https://www.zetetic.net/sqlcipher/sqlcipher-for-android/) package. ---
**Author:** ![Abu\_Basith](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/abu_basith/32/2049_2.png) [@Abu\_Basith](https://discuss.zetetic.net/u/Abu_Basith)\ **Post date:** [October 4, 2023, 7:15am UTC](https://discuss.zetetic.net/t/sqlcipher-4-5-4v-contains-which-version-of-openssl/6029/9 "2023-10-04T07:15:36Z")
@sjlombardo - What is the meaning of non-FIPS packages? and sqlcipher-android is comes under on-FIPS? ---
**Author:** ![sjlombardo](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.zetetic.net/sjlombardo/32/3_2.png) [@sjlombardo](https://discuss.zetetic.net/u/sjlombardo)\ **Post date:** [October 4, 2023, 1:26pm UTC](https://discuss.zetetic.net/t/sqlcipher-4-5-4v-contains-which-version-of-openssl/6029/10 "2023-10-04T13:26:17Z")
Hello @Abu_Basith - It basically means any standard distributions of community, commercial, or enterprise packages which use OpenSSL. [SQLCipher Enterprise FIPS](https://www.zetetic.net/sqlcipher/fips/) is a special set of packages that use a [FIPS 140-2](https://csrc.nist.gov/pubs/fips/140-2/upd2/final) validated cryptographic module. Such packages are clearly marked and only distributed through our Enterprise program under a special license. If you do not have a specific FIPS package license from Zetetic then your `sqlcipher-android` packages are non-FIPS.