Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update SQLite and OpenSSL #688

Closed
mhsmith opened this issue Aug 22, 2022 · 1 comment
Closed

Update SQLite and OpenSSL #688

mhsmith opened this issue Aug 22, 2022 · 1 comment
Milestone

Comments

@mhsmith
Copy link
Member

mhsmith commented Aug 22, 2022

A CVE search of our bundled libraries returned the following results:

Chaquopy_CVE.xlsx

The xz issue is irrelevant because it only affects the command line tool "xzgrep", which is not included with Chaquopy. And the pip issue only affects you if you're installing software from untrusted Git repositories, in which case you have bigger problems. However, the large number of SQLite and OpenSSL issues definitely justify an upgrade.

We should move to OpenSSL 3, because version 1.1.1 goes out of support in 2023-09. However, this may cause ripemd160 to no longer be supported by hashlib, because OpenSSL has moved it to the "legacy provider". This affects all operating systems, so we might not need to work around it, just remove ripemd160 from test_android.

@mhsmith
Copy link
Member Author

mhsmith commented Aug 31, 2022

Python is only compatible with OpenSSL 3 in versions 3.9 and later (python/cpython#83001), so for older versions we'll continue to use OpenSSL 1.1

@mhsmith mhsmith added this to the 12.1 milestone Sep 2, 2022
mhsmith added a commit that referenced this issue Sep 5, 2022
Replace OpenSSL-only hash algorithm ripemd160 with sm3 (#688)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant