Google play and Adobe air: Security Alert: You are using a highly vulnerable version of OpenSSL

[Guest]

Hello

I just got a message from google play and they said that tehre is a vulnerable version of openssl. Now since I use adobe air to do my apps I was wondering how adobe air can comunnicate with openssl?

I'm using different version of adobe air since 1 years.

Here was the complete message:

Hello,

One or more of your apps is running an outdated version of OpenSSL, which has multiple security vulnerabilities. You should update OpenSSL as soon as possible. For more information about the most recent security vulnerability in OpenSSL, please see http://www.openssl.org/news/secadv_20140605.txt.

Please note, while it's unclear whether these specific issues affect your application, applications with vulnerabilities that expose users to risk of compromise may be considered “dangerous products” and subject to removal from Google Play.

Regards,
Google Play Team

©2014 Google Inc.
1600 Amphitheatre Parkway
Mountain View, CA 94043

Email preferences: You have received this mandatory email service announcement to update you about important changes to your Google Play account.

Do you know how to fix that problem?

Bobby

[mola2alex]

That is how you install the SDK in CC but when you publish your project, make sure to change the SDK you were using before.  You have it installed, now you need to target it as Flash CC allows you to have multiple versions.  When you hit, File, Publish Settings, you should see a drop down and select the appropriate new SDK verison.  I believe any SDK version after AIR 14.0.0.125 has the SSL security fix.

[flashrocker]

Thank you. I wanted to be sure, that the downloaded AIR SDK has the SSL security fix. In the meantime I have rendered and uploaded my apps and everything worked like expected.

[Roostergames]

İ Get a alert from google play. Adobe air sdk 16. open ssl's which version using ?

[kanthi_gm]

Hi

     Do we have to update ANE's as well ? Also is the issue fixed with AIR 15 ?

Regards,

Kanthi,

[Roostergames]

Yes, who is getting this error. Uptade your app or game with air latest sdk. Your alert will clear

[kanthi_gm]

What about the ANE's ?

[Driezzy]

The problem seems to be fixed with SDK 16. I got the error with SDK 14 and 15, I hope I don't get it with the current SDK.

Thanks!

[Roostergames]

Your application is using OpenSSL with Adobe  Air SDK. You must update your Air sdk latest version (16) and rebuild your application. This is your solution.

[kanthi_gm]

Dear Roostergames,

     I understand that the application has to be rebuild with the latest AIR SDK 16. Im trying to know if the ANE's also have to be rebuild with  latest version of the AIR SDK.

Regards,

Kanthi.

[seasonw]

I don't think ANE need to be recompile because it did not build with OpenSSL usage.

[thx1138]

Unless the ANE uses a version of OpenSSL then you do not need to update the ANE. You will need to check with the author / manufacturer to see if they used OpenSSL in their ANE.

[kanthi_gm]

Hi

    It worked for us with AIR 15.0.0. Thank you for support guys.

Regards,

Kanthi.

[knoppers]

Hi,

I've published my game again with AIR 17 but i've got the Google message again asking me to migrate to a newer version of OpenSSL. It's an error of them, maybe automatically sending the message without checking that i've fixed the problem os there is something more i should do?

Also, how can i check the OpenSSL version of an APK file? i've seen many posts with people explaining how to do it in command line but i dont understand and it's for linux (i have windows 8.1)... is there an easy way?

Thanks.

[dcastillo1]

Last game published using AIR SDK 20.0 is also getting the warning. I think is an admob ANE that I am using. I will confirm once I can check back at home

[TheStalwart]

AIR SDK 20.0 is using OpenSSL 1.0.2d 9 Jul 2015

AIR SDK 21.0 is using OpenSSL 1.0.2f  28 Jan 2016

So AIR SDK 21.0 is not affected and unless you're using ANEs that bundle OpenSSL, you should just update AIR SDK and you're safe.

[TheStalwart]

Our project is not using AdMob, but got the same warning for APK built with AIR 19.0.

We had an APK built with AIR 21.0 published to alpha channel, but affected version specifically stated the old one.

[Edanesh123]

Hi All
I also got this OpenSSL alert  trying to launch my app for the first time.

I used AIR 21 and got this alert,

then I tried the latest AIR 22.149 BETA - and the alert went away 

I am using captive air (off course) & Flash Animate to publish

[devetDesat]

What exact AIR 21 version do you have?

AIRSDK 21 198 is working fine.

[Anki_AG_]

Hi Edan,

AIR 21 containts OpenSSL version 1.02f. There should be no alert using this SDK. Please confirm if you are seeing error with AIR 21.

Thanks,

Ankit

Adobe Air Team

[Edanesh123]

I confirm I got the alert with  version  AIR 21.0.0.123

version AIR 22 beta - is good and has no alert

Edan

[Anki_AG_]

Hi Edan,

You are right. We have changed it after that. You can use the latest version of AIR SDK 21.

Thanks,

Ankit

Adobe Air Team

[Edanesh123]

Is Version AIR SDK 21.0.0.215 safe ?

because I can not find version 21.0.0.198 anymore

[Anki_AG_]

Hi,

We have updated AIR SDK 19 with the new OpenSSL version 1.0.2f. Please visit Find and download archived versions of Adobe AIR SDK  and download AIR SDK 19.0.0.249. Please let us know in case of any issues.

Thanks,

Ankit

Adobe AIR Team

[Frédéric C.]

Thank you very much for this ! I am always delighted to see great support from the Adobe team

[hitarth]

Hi.

I'm using Flash Professional CC 2014. Will it be compatible with it? (SDK 19) ?

Thanks,

Hitarth