workspace-ONE-SDK-integration-samples
workspace-ONE-SDK-integration-samples copied to clipboard
Update the openssl dependency to avoid problems with vulnerabilities
Describe the bug
I'm using your integration package for flutter v24.2.0. When scanning the application for vulnerabilities, they tell me that the [email protected] library has several vulnerabilities: CVE-2023-5678, CVE-2018-16395, CVE-2016-7798.
Scan details
Reproduction steps
- integrate your SDK package into the flutter application
- scan the application for vulnerabilities (for example using the https://ostorlab.co/ service)
- see that the application will have several vulnerabilities (including those related to openssl with high-risk, but it would be useful to look at the others, which are of lower priority)
Expected behavior
Using a newer version of the openssl dependency, which is not subject to vulnerabilities
p.s. I didn’t find how I can send this report to you in the “security” section, or by email, so I’m leaving it here
@novikov1337danil - we are on OpenSSL 1.0.2zi, we have analyzed that the vulnerabilities (High and Medium) reported above are not impacting the flow that we use from the OpenSSL library.