What the developer wrote
Authored by Sander van Grieken
android: openssl 3.0.18
What changed, and why it matters
This commit changes the version of OpenSSL used in Electrum's Android build from 3.3.1 to 3.0.18. It also removes a safety check that ensured the expected version was being used. The change appears to be a downgrade to an older OpenSSL version, which could reintroduce known security vulnerabilities that were fixed in newer releases. However, the commit message gives no explanation, and no security advisory or vendor statement is supplied.
Review why the Android build was downgraded from OpenSSL 3.3.1 to 3.0.18. Check OpenSSL 3.0.18 advisories for unpatched CVEs compared with 3.3.1, restore the version assertion if possible, and document the rationale. If the downgrade is not strictly necessary, revert to the newer supported branch.
Security signals we found
Downgrade of a cryptographic library to an older branch
Removal of a build-time version assertion
No security justification or CVE reference in commit message
Evidence from the diff
The patch modifies contrib/android/p4a_recipes/openssl/init.py. It comments out the assertion OpenSSLRecipe._version == "3.3.1", sets version = "3.0.18", and updates the SHA-512 checksum to match the 3.0.18 source tarball. This pins the Android build to OpenSSL 3.0.18 instead of 3.3.1. OpenSSL 3.0.x is an older branch than 3.3.x and may lack security fixes present in 3.3.1. Without vendor context, the motivation is unclear; it could be a compatibility workaround or a deliberate downgrade. The removal of the version assertion weakens build-time verification.
Changed components
Electrum Android build recipeOpenSSL dependency for Android buildsInspect captured patch +3 / −2
diff --git a/contrib/android/p4a_recipes/openssl/__init__.py b/contrib/android/p4a_recipes/openssl/__init__.py
index 501d0bc..062b18e 100644
--- a/contrib/android/p4a_recipes/openssl/__init__.py
+++ b/contrib/android/p4a_recipes/openssl/__init__.py
@@ -6,13 +6,14 @@ from pythonforandroid.util import load_source
util = load_source('util', os.path.join(os.path.dirname(os.path.dirname(__file__)), 'util.py'))
-assert OpenSSLRecipe._version == "3.3.1"
+# assert OpenSSLRecipe._version == "3.3.1"
assert OpenSSLRecipe.depends == []
assert OpenSSLRecipe.python_depends == []
class OpenSSLRecipePinned(util.InheritedRecipeMixin, OpenSSLRecipe):
- sha512sum = "d3682a5ae0721748c6b9ec2f1b74d2b1ba61ee6e4c0d42387b5037a56ef34312833b6abb522d19400b45d807dd65cc834156f5e891cb07fbaf69fcf67e1c595d"
+ version = "3.0.18"
+ sha512sum = "6bdd16f33b83ae2a12777230c4ff00d0595bbc00253ac8c3ac31e1375e818fc74d7f491bd2e507ff33cab9f0498cfb28fa8690f75a98663568d40901523cdf3c"
recipe = OpenSSLRecipePinned()
Why this scored 27/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.