Our scan tool reports vulnerabilies [CVE-2024-5535] in openssl 1. 1.1q used by SQLCipher 4.5.2.Does these vulnerabilities affect the library net.zetetic:androidx-database-sqlcipher? Thaniks

[lierliang12345]

Our scan tool reports vulnerabilies [CVE-2024-5535] in openssl 1. 1.1q used by SQLCipher 4.5.2.Does these vulnerabilities affect the library net.zetetic:androidx-database-sqlcipher?
Thaniks

[developernotes]

Hi @lierliang12345,

SQLCipher is not impacted by CVE-2024-5535 as it does not utilize SSL_select_next_proto or TLS in general.

[lierliang12345]

We only use SQLCipher 4.5.2 to encrypt and decrypt Android local database information. Check whether OpenSSL 1.1.1q capabilities are not used and whether OpenSSL 1.1.1q is not affected by all OpenSSL vulnerabilities.
Thaniks