OpenSSL - Google Play "The vulnerabilities were addressed in OpenSSL 1.02f/1.01r"

[grosssmutttr]

Just got a warning sign behind every app in the Google Play developer console.

So I remember this issue already appeared a year ago:

How to address OpenSSL vulnerabilities in your apps - Google Help

Currently I'm using AIR 20.

Is this issue also part of the current AIR 21?

Best

omi

[natural_criticB837]

Adobe Animate CC is maintained by a different team, so chances are they are not aware that Air 19 still has a valid usecase. I assume you will have to use the command line to build your product for Air in this case. That sounds worse than it is, though. You could also download FlashDevelop (its free), which comes with Android project templates that do the command line call for you. FlashDevelop organizes the compliation in .bat files, so you can also copy the command line call to build your .apk from there.

[Colin Holgate]

I can't remember what the use case is for AIR 19 instead of a more recent one, but an easier solution than FlashDevelop or the command line would be to install a previous version of Flash Pro CC. That can live alongside the current Animate, and you would only need to open it when you're doing final builds.

[bslote]

@Colin, did you really forget about the memory problems that made AIR 20+ unusable for many of us?

Bug#4101613 - [android]memory problem on airSDK20

Adobe AIR 20 , out of memory on ByteArray/inflate()

[Colin Holgate]

Are those still true in AIR 21 and 22?

[natural_criticB837]

The actual usecase for Air 19, apart from bugs I am not aware of, is that it is the last version to support Android below version 4. Some of us still have a fair amount of users on Android 2

[krgupta]

Hello Everyone,

We would like to fix the problem with ObjectUtil.copy or any other related issue with Bytearrays in AIR 22 but for that we need a sample application to reproduce for the investigations. Please send it to me directly at krgupta AT adobe DOT com.

Thanks,

Krati

[dasessig]

I published my latest App with Adobe Air 21.0.0.128 - it received the same OpenSSL Warning as all my other Apps.

Yay

[Mark.fromOP]

Same here, about 8 apps some published as recent as November with the latest AIR.

You guys remember this happened last year? Then later I got an email saying it was an error and everything went back to normal. I am almost certain this is an error, perhaps whatever tool they use to determined which apps are in violation does not work properly with AIR apps. Don't panic just yet.

Also an interesting side note my active apps got flagged but apps I have basically given up on that have not been touched for 3 years built with AIR 2.3-3.0 did not receive the warning so how does that make any sense?

[Flipline]

I think when that error happened last time, they were claiming the AIR app had an earlier version of OpenSSL than it actually had.  This time it looks like the version they're requiring is legitimately newer than what our AIR apps have --- my AIR 18 apps have 1.01m and they're looking for 1.01r or 1.02f (not sure if AIR 19 or 20 or 21 did bump it up to 1.01r since then).

[edutor25]

Check your google play accounts again.

Warnings are removed. Thanks God!

[Flipline]

Nice!  Same here.  Glad we don't have to worry about that now

[Applauz78]

Cant tell you how happy I am that I don't have to re-package 22 apps.

[Guest]

I'm still seeing this flagged as an issue in Google Play on our App with Air 19 ?

I'm not convened this has gone away...

[shajby82]

I think AIR 21.0 resolves this, I updated one of my apps with AIR 21.0 yesterday and the app is the only one now that does not show the warning for me..

[edutor25]

Adobe Air SDK 21.0.0.128 is using openSSL version 1.0.2d

Adobe Air version 21.0.0.150 is using openSSL version 1.0.2f

We have to download Adobe Air here Download Adobe AIR 21 Beta - Adobe Labs  (The date is wrong (Date Feb 17, 2016)  this version is from March (read the pdf).

[grosssmutttr]

Just tested

21.0.0.176

and it seems as if it is not working...

[edutor25]

21.0.0.150 is working for me, 3 apps updated yesterday and warnings disappear. Try with 21.0.0.150 is using openSSL version 1.0.2f.

[Infin8]

"and it seems as if it is not working".

Following the upload of your new apk file, the alert will still present itself on the list of apps, but it will be referring the the previous apk version number.

If you go into 'Alerts' and dismiss the alert this should remove it.

[grosssmutttr]

If I remove the alert without changing anything the alert also disappears so I don't really know whether the issue is fixed....

[LilGames]

Dismissing an Alert only acknowledges that you've read it. You're still responsible for addressing the isse that was raised before the deadline.

[grosssmutttr]

So now I'm using version 21.0.0.176 and I dismiss the alerts.

So the alert would come back again if the issue isn't resolved?

[LilGames]

That's my understanding, though I am not 100% sure.

[Roostergames]

who tried with AIR SDK 21.0.0.176 ? If this version using 1.02f alerts must delete. Because Google wrote in official article. Must use OPEN ssl 1.02f / 1.01r or higher version.

who tried new app update with 21.0.0.176 and what is the result ?

[grosssmutttr]

Hi Roostergames,

I tried with version 21.0.0.176.

After uploading updates of all my apps I deleted the warnings and up to now they didn't appear again, so I think the issue is solved...

[Lars Laborious]

You didn't really need to delete the warnings. I updated two of my apps (version 21.0.0.176), waited one day for Google to catch up, and now the warnings are removed from those two apps.