CODEWITHSUNDEEP
androidsecurityopensslgoogle-playcertificate
Ionel
Ionel

Reputation: 31

GmsCore_OpenSSL can provoke app rejected from Google Play with all updated?

I guess more than one received one mail from Google Play with the Message :

"Hello Google Play Developer,

We wanted to let you know that your app(s) listed below statically link against a version of OpenSSL that has multiple security vulnerabilities for users. Please migrate your app(s) to an updated version of OpenSSL by 7/7/15. Starting on this date, Google Play will block publishing of any new apps and updates that use unsupported versions of OpenSSL.

REASON FOR WARNING: Violation of the dangerous products provision of the Content Policy and section 4.4 of the Developer Distribution Agreement. The vulnerabilities were fixed in OpenSSL versions beginning with 1.0.1h, 1.0.0m, and 0.9.8za. To confirm your OpenSSL version, you can do a grep via:

$ unzip -p YourApp.apk | strings | grep "OpenSSL"

For more information about the vulnerability, please see this OpenSSL Security Advisory. To confirm you’ve upgraded correctly, submit the updated version of the app(s) to the Developer Console and check back after five hours. Starting on 7/7/15, we will not accept app updates containing the vulnerabilities. Any new apps containing the vulnerabilities will be rejected."

So i read many posts about this , like Post 1 , Post 2 and others. and i must say that in my first version of app i don't use any library, all from Android ( I use webview ) and when i use "unzip -p YourApp.apk | strings | grep "OpenSSL"" in my first app i dont have any OpenSSL.

In my present version i use library like : app-compact:22.2.0 ( from android,latest version ) , gms:7.5.0 ( from android, latest version ) and volley ( 1.0.16 ) and when i use "unzip -p YourApp.apk | strings | grep "OpenSSL"" gives me like result GmsCore_OpenSSL . I guess GmsCore_OpenSSL is from the library of gms so is native from Android .

Thank you advanced,

Upvotes: 1

Views: 3357

Answers (1)

Antimony
Antimony

Reputation: 39451

The tool you use to sign the APK doesn't matter. If you already searched every file in the APK and couldn't find any uses of old OpenSSL, the next step is to check all the files that your APK uses indirectly.

There was one case of an App that downloaded Busybox, and Busybox contained curl, which contained an old version of OpenSSL, which caused it to get flagged.

So if you are downloading any native code libraries, run strings | grep "OpenSSL" and make sure they are up to date too.

Upvotes: 1

Related Questions