Skip to main content
A
Anonymous
June 13, 2014
Question

Google play and Adobe air: Security Alert: You are using a highly vulnerable version of OpenSSL

  • June 13, 2014
  • 33 replies
  • 43348 views

Hello

I just got a message from google play and they said that tehre is a vulnerable version of openssl. Now since I use adobe air to do my apps I was wondering how adobe air can comunnicate with openssl?

I'm using different version of adobe air since 1 years.

Here was the complete message:

Hello,

One or more of your apps is running an outdated version of OpenSSL, which has multiple security vulnerabilities. You should update OpenSSL as soon as possible. For more information about the most recent security vulnerability in OpenSSL, please see http://www.openssl.org/news/secadv_20140605.txt.

Please note, while it's unclear whether these specific issues affect your application, applications with vulnerabilities that expose users to risk of compromise may be considered “dangerous products” and subject to removal from Google Play.

Regards,
Google Play Team

©2014 Google Inc.
1600 Amphitheatre Parkway
Mountain View, CA 94043

Email preferences: You have received this mandatory email service announcement to update you about important changes to your Google Play account.

Do you know how to fix that problem?

Bobby

    This topic has been closed for replies.

    33 replies

    V
    Vivid75
    Known Participant
    March 8, 2017

    In addition to the OpenSSL issue, could you please address the TLS 1.2 issue on Android. Since secureSockets don't work, we are unable to connect to any secure server to get and send data.

    E
    Edanesh123
    Participating Frequently
    June 1, 2016

    Hi All
    I also got this OpenSSL alert  trying to launch my app for the first time.

    I used AIR 21 and got this alert,

    then I tried the latest AIR 22.149 BETA - and the alert went away 

    I am using captive air (off course) & Flash Animate to publish

    D
    devetDesat
    Participant
    June 1, 2016

    What exact AIR 21 version do you have?

    AIRSDK 21 198 is working fine.

    TheStalwart
    TheStalwart
    Inspiring
    March 31, 2016

    Our project is not using AdMob, but got the same warning for APK built with AIR 19.0.

    We had an APK built with AIR 21.0 published to alpha channel, but affected version specifically stated the old one.

    dcastillo1
    dcastillo1
    Participating Frequently
    March 31, 2016

    Last game published using AIR SDK 20.0 is also getting the warning. I think is an admob ANE that I am using. I will confirm once I can check back at home

    TheStalwart
    TheStalwart
    Inspiring
    March 31, 2016

    AIR SDK 20.0 is using OpenSSL 1.0.2d 9 Jul 2015

    AIR SDK 21.0 is using OpenSSL 1.0.2f  28 Jan 2016

    So AIR SDK 21.0 is not affected and unless you're using ANEs that bundle OpenSSL, you should just update AIR SDK and you're safe.

    K
    knoppers
    Participating Frequently
    June 12, 2015

    Hi,

    I've published my game again with AIR 17 but i've got the Google message again asking me to migrate to a newer version of OpenSSL. It's an error of them, maybe automatically sending the message without checking that i've fixed the problem os there is something more i should do?

    Also, how can i check the OpenSSL version of an APK file? i've seen many posts with people explaining how to do it in command line but i dont understand and it's for linux (i have windows 8.1)... is there an easy way?

    Thanks.

    Roostergames
    Roostergames
    Participating Frequently
    December 23, 2014

    Your application is using OpenSSL with Adobe  Air SDK. You must update your Air sdk latest version (16) and rebuild your application. This is your solution.

    K
    kanthi_gm
    Participating Frequently
    December 23, 2014

    Dear Roostergames,

         I understand that the application has to be rebuild with the latest AIR SDK 16. Im trying to know if the ANE's also have to be rebuild with  latest version of the AIR SDK.

    Regards,

    Kanthi.

    seasonw
    seasonw
    Participating Frequently
    December 24, 2014

    I don't think ANE need to be recompile because it did not build with OpenSSL usage.

    K
    kanthi_gm
    Participating Frequently
    December 22, 2014

    Hi

         Do we have to update ANE's as well ? Also is the issue fixed with AIR 15 ?

    Regards,

    Kanthi,

    Roostergames
    Roostergames
    Participating Frequently
    December 22, 2014

    Yes, who is getting this error. Uptade your app or game with air latest sdk. Your alert will clear

    K
    kanthi_gm
    Participating Frequently
    December 22, 2014

    What about the ANE's ?

    Roostergames
    Roostergames
    Participating Frequently
    December 19, 2014

    İ Get a alert from google play. Adobe air sdk 16. open ssl's which version using ?

    F
    flashrocker
    Participant
    July 9, 2014

    So is this the appropriate version, that fixes the OpenSSL problem?

    7/8/2014 - Release - AIR 14 Runtime and SDK

    (I did not want to work with a beta so I waited for the release of the regular version)

    This is the first time, that I get in contact with SDKs, which have to be installed manually. So I hope I made everything right. I use a Mac / Maverick.

    First I tried it with the runtime for Mac, but this did not work. I have installed it, but it I was not able to choose it in FlashCC with the AIR SDK manager.

    Then I tried the SDK & Compiler for Macintosh. I downloaded it and copied the folder (AIRSDK_Compiler) in the FlashCC folder and integrated it with the "+" Button of the AIR SDK manager of Flash. It seemed to work. Now I can choose AIR 14.0.0.137 for Android, IOS, or desktop in Flash CC.

    Still I am a little bit concerned, if I did everything right. (No experience with AIR SDK installing).

    I want to render my existing Android Apps again with the new and safe AIR version  and update them in Google Play.

    Did I install the right version in a valid way?

    M
    mola2alex
    Inspiring
    July 10, 2014

    That is how you install the SDK in CC but when you publish your project, make sure to change the SDK you were using before.  You have it installed, now you need to target it as Flash CC allows you to have multiple versions.  When you hit, File, Publish Settings, you should see a drop down and select the appropriate new SDK verison.  I believe any SDK version after AIR 14.0.0.125 has the SSL security fix.

    F
    flashrocker
    Participant
    July 10, 2014

    Thank you. I wanted to be sure, that the downloaded AIR SDK has the SSL security fix. In the meantime I have rendered and uploaded my apps and everything worked like expected.

    A
    Anonymous
    June 20, 2014

    Hello Chris

    Thank you Very much for your help and the beta version. I'm going to try it now.

    Thanks again

    Bobby

    Show more replies
    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices