android build: bump openssl (3.0.18 -> 3.0.21)
What the developer wrote
Authored by SomberNight
android build: bump openssl (3.0.18 -> 3.0.21)
What changed, and why it matters
This commit updates the version of OpenSSL used when building the Electrum Android app from 3.0.18 to 3.0.21, along with the matching cryptographic fingerprint (SHA-512 hash). OpenSSL is a widely used library that provides encrypted connections. Newer patch releases typically fix security bugs in the older version, so this is likely a routine dependency update to address known vulnerabilities in OpenSSL 3.0.18. However, the commit message does not say which specific bugs are being fixed, and no separate security advisory was supplied.
Verify the new SHA-512 hash against the official OpenSSL 3.0.21 source release, confirm the Android build still compiles and links correctly, and review the OpenSSL 3.0.19–3.0.21 changelogs for CVEs relevant to Electrum's TLS usage. Consider documenting the security rationale in the commit or release notes.
Security signals we found
Dependency version bump for a security-sensitive library (OpenSSL)
OpenSSL 3.0.18 is superseded by newer 3.0.x patch releases that typically include CVE fixes
No explicit CVE or security rationale in commit message
SHA-512 hash updated to match new tarball, preserving supply-chain verification
Evidence from the diff
The change is limited to contrib/android/p4a_recipes/openssl/init.py, bumping the pinned OpenSSL version for the Android Python-for-Android build from 3.0.18 to 3.0.21 and updating the sha512sum used to verify the downloaded source tarball. OpenSSL 3.0.21 is a patch release in the 3.0 LTS branch; such bumps commonly include CVE fixes. Without an explicit advisory or changelog reference we cannot map this to a specific CVE, but staying on an older patch level generally carries known security risk. The commit itself is a straightforward version/hash bump with no functional code changes in Electrum.
Changed components
Android build recipe for OpenSSLcontrib/android/p4a_recipes/openssl/__init__.pyInspect captured patch +2 / −2
diff --git a/contrib/android/p4a_recipes/openssl/__init__.py b/contrib/android/p4a_recipes/openssl/__init__.py
index 062b18e..dc9a500 100644
--- a/contrib/android/p4a_recipes/openssl/__init__.py
+++ b/contrib/android/p4a_recipes/openssl/__init__.py
@@ -12,8 +12,8 @@ assert OpenSSLRecipe.python_depends == []
class OpenSSLRecipePinned(util.InheritedRecipeMixin, OpenSSLRecipe):
- version = "3.0.18"
- sha512sum = "6bdd16f33b83ae2a12777230c4ff00d0595bbc00253ac8c3ac31e1375e818fc74d7f491bd2e507ff33cab9f0498cfb28fa8690f75a98663568d40901523cdf3c"
+ version = "3.0.21"
+ sha512sum = "9be1c8c11a2d55417bb177804d1b5369aa54a9dcd2e136929509457d549697407ae9611079e94c61b58a95be598ce35b94edb336e050d1019e7269f4d2f52cda"
recipe = OpenSSLRecipePinned()
Why this scored 47/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.