Python target runtimes ship OpenSSL 3.0.18 (CVE-2025-15467) #1482

Chaquopy version

17.0.0

Devices or emulators where the issue happens

Not device-specific: found in the arm64-v8a and x86_64 target packages.

Relevant parts of your code

N/A. This is in the Chaquopy-provided runtime, not app code.

Describe your issue

The OpenSSL libraries in the Python target packages report version 3.0.18:

com.chaquo.python:target:3.11.14-0: jniLibs/{arm64-v8a,x86_64}/libcrypto_python.so contains OpenSSL 3.0.18 30 Sep 2025
Python 3.12 / 3.13 / 3.14 targets

3.0.18 is in the affected range of CVE-2025-15467 (High; CMS (Auth)EnvelopedData parsing), which is fixed in 3.0.19: https://openssl-library.org/news/secadv/20260127.txt. OpenSSL's release policy also lists 3.0 as no longer supported: https://openssl-library.org/policies/releasestrat/

_ssl, _hashlib and packages that link Chaquopy's OpenSSL load these runtime libraries, so apps can't update them through pip or their own dependencies.

Could the targets be rebuilt against a supported OpenSSL release, ideally the 3.5 LTS series, or 3.0.19 or later as a stopgap? If there's a supported way for apps to provide their own OpenSSL build in the meantime, that would also help.