Skip to main content
Participating Frequently
June 11, 2015
Question

OpenSSL warning persisting with AIR 17

  • June 11, 2015
  • 0 replies
  • 431 views

Hi,

Some months ago, as many of you, i got the Google warning that asked me to update de OpenSSL version of my APK. A month ago i saw that it was fixed with AIR 14 SDK, so i published the game again with the last SDK available (it was AIR 17), but today i've got the Google message again aking me to migrate to a newer version of OpenSSL.

It's an error of them, maybe automatically sending the message without checking that i've fixed the problem os there is something more i should do?

Thanks.

This is the Google message:

Hello Google Play Developer,

We wanted to let you know that your app(s) listed below statically link against a version of OpenSSL that has multiple security vulnerabilities for users. Please migrate your app(s) to an updated version of OpenSSL by 7/7/15. Starting on this date, Google Play will block publishing of any new apps and updates that use unsupported versions of OpenSSL.

REASON FOR WARNING: Violation of the dangerous products provision of the Content Policy and section 4.4 of the Developer Distribution Agreement.

The vulnerabilities were fixed in OpenSSL versions beginning with 1.0.1h, 1.0.0m, and 0.9.8za. To confirm your OpenSSL version, you can do a grep via:

$ unzip -p YourApp.apk | strings | grep "OpenSSL"

For more information about the vulnerability, please see this OpenSSL Security Advisory. To confirm you’ve upgraded correctly, submit the updated version of the app(s) to the Developer Console and check back after five hours.

Starting on 7/7/15, we will not accept app updates containing the vulnerabilities. Any new apps containing the vulnerabilities will be rejected.

While these issues may not affect every app that uses OpenSSL versions prior to 1.0.1h, 1.0.0m, or 0.9.8za, it’s best to stay up to date on all security patches. Make sure to update any libraries in your app that have known issues, even if you're not sure the issues are relevant to your app.

This topic has been closed for replies.