Mitigating SQLCipher Vulnerabilities Reported During VAPT in CA Mobile Authenticator and DeviceDNA iOS SDKs

Products

• CA Strong Authentication

Issue/Introduction

After performing a Vulnerability Assessment and Penetration Test (VAPT) on an application that uses the following iOS SDK components from the CA Advanced Authentication suite:

• CA Mobile Authenticator iOS SDK version 2.2.2

• CA DeviceDNA iOS SDK version 8.4.1

The scan reported multiple vulnerabilities originating from the SQLCipher dependency used by these SDKs.

Vulnerability Details:

Component	Package	Version	Vulnerabilities	CVSS Score	References
SQLCipher	org.cocoapods.SQLCipher	3.4.2	CVE-2025-6965, CVE-2025-3277, CVE-2023-7104, CVE-2022-35737, CVE-2020-15358, CVE-2020-13632, CVE-2020-13631, CVE-2020-13630, CVE-2020-13435, CVE-2020-13434, CVE-2020-11656, CVE-2020-11655, CVE-2019-8457, CVE-2019-19646, CVE-2019-19645, CVE-2019-16168, CVE-2018-8740, CVE-2018-20506, CVE-2018-20505, CVE-2018-20346, CVE-2017-15286	9.8	SQLCipher Project, NVD Details

Environment

CA Strong Authentication 9.1.5

• CA Mobile Authenticator iOS SDK version 2.2.2
• CA DeviceDNA iOS SDK version 8.4.1
•  

Cause

The reported vulnerabilities are inherited from the SQLCipher 3.4.2 library version used within the SDKs. These issues are not directly part of Broadcom’s source code but stem from the third-party dependency.

Resolution

The Advanced Authentication Engineering team has developed an updated SDK version that includes an upgraded SQLCipher dependency to mitigate the vulnerabilities.

• SQLCipher upgraded from 3.4.2 → 4.10.0

• This new version addresses the CVEs identified in the VAPT scan.

• The patch has been verified internally and is available for customer testing.

Action Steps:

1. Obtain the updated SDK package from the attachment.

2. Integrate the new SDK into your application.

3. Perform regression testing in your lower/non-production environment.

4. Re-run your vulnerability scan.

5. Confirm that the vulnerabilities are no longer reported.

If you continue to observe any reported vulnerabilities post-upgrade, please open a new support case with your scan results for further review.

Status:

Fix Released – SQLCipher dependency upgraded to version 4.10.0
Availability: General Availability (GA) build is available as attached in the article.

Additional Information

 

• Customers are encouraged to always use the latest SDK versions to ensure ongoing compliance with security and platform requirements.

• This fix is applicable only to iOS SDK components; Android SDK updates were addressed separately in a prior release.