You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The xz issue is irrelevant because it only affects the command line tool "xzgrep", which is not included with Chaquopy. And the pip issue only affects you if you're installing software from untrusted Git repositories, in which case you have bigger problems. However, the large number of SQLite and OpenSSL issues definitely justify an upgrade.
We should move to OpenSSL 3, because version 1.1.1 goes out of support in 2023-09. However, this may cause ripemd160 to no longer be supported by hashlib, because OpenSSL has moved it to the "legacy provider". This affects all operating systems, so we might not need to work around it, just remove ripemd160 from test_android.
A CVE search of our bundled libraries returned the following results:
Chaquopy_CVE.xlsx
The xz issue is irrelevant because it only affects the command line tool "xzgrep", which is not included with Chaquopy. And the pip issue only affects you if you're installing software from untrusted Git repositories, in which case you have bigger problems. However, the large number of SQLite and OpenSSL issues definitely justify an upgrade.
We should move to OpenSSL 3, because version 1.1.1 goes out of support in 2023-09. However, this may cause ripemd160 to no longer be supported by hashlib, because OpenSSL has moved it to the "legacy provider". This affects all operating systems, so we might not need to work around it, just remove ripemd160 from test_android.
The text was updated successfully, but these errors were encountered: