Google email says to migrate to OpenSSL 1.02f/1.01r

[David]

Has anyone else received the Google Play email stating the following:

"Please migrate your app(s) to OpenSSL 1.02f/1.01r or higher as soon as possible and increment the version number of the upgraded APK. Beginning July 11, 2016, Google Play will block publishing of any new apps or updates that use older versions of OpenSSL. If you’re using a 3rd party library that bundles OpenSSL, you’ll need to upgrade it to a version that bundles OpenSSL 1.02f/1.01r or higher."

I have searched my project and the only references I am finding are in the file everlive.all.js; so I presume this is something that Telerik will need to fix?

Please advise.

[Anton Dobrev]

Hi David,

Thanks for bringing the issue to our attention.

The Everlive JS SDK uses an external dependency for cryptography methods for encrypting the offline storage (please see more on the matter here). This module contains properties and fields named "OpenSSL" which indicate methods for interopability with OpenSSL but does not reference the OpenSSL module.

This said the check Google are recommending will return results for a string "OpenSSL" but the OpenSSL module in question is not used in the SDK. Perhaps the presence of such strings may be a reason for the app to be considered as using a version of OpenSSL that is not allowed.

While we are researching the issue, can you please:

- Specify if the message was sent at the time of submitting your app for publishing.
- Check with the attached version of the SDK - it does not use the cryptography module. In case you are not using the offline storage (respectively encryption) in your app, you may not need this module for communicating with Everlive. Please use this just as verification that the issue stands in the Everlive SDK and use the official release for production purposes.

Let us know should you have further questions or considerations.

Regards,
Anton Dobrev
Telerik

 

 

[Anton Dobrev]

Hi David,

Just a quick follow up to your inquiry.

We created a simple hybrid application in Telerik Platform and published it to Google Play. The app was approved and published without warnings. 

The project properties are:

- Cordova 4
- Everlive JavaScript SDK 1.6.9 (min and src versions) embedded locally in the app
- All Cordova Core plugins enabled in the project (except for the Keyboard and Console)

I hope that this information will be helpful for you.

Regards,
Anton Dobrev
Telerik

 

 

[David]

Anton,

I was able to get my app published as well, however Google has a yellow warning triangle with a warning next to my app stating that it is using a vulnerable OpenSSL.  See attached image.

Does your sample app have that warning?

Is there a list or log in Visual Studio that would show what modules are included?

I have not had a chance to try your temporary SDK, but thought I would check first to see if your app had the warning.

Thanks,
David

[Anton Dobrev]

Hello David,

Thanks for writing back.

When preparing and publishing the test app there were no warnings in the Google Play portal. I asked again my colleagues that published the app on my behalf on the same subject and they confirmed no similar warnings were displayed.

Given the nature of the issue my suggestion would be to double check:

- The Cordova version of the app - using Cordova 4.0 in Telerik Platform (4.1.1 for Android) is minimum acceptable version for Google Play store after May 2016.
- External plugins, SDKs, frameworks used in the app or located in the application package - I am suspecting a given library may have a dependency to OpenSSL or perform an operation using OpenSSL. This operation, however, may not appear when scanning the code for the openssl string match.
- If external plugins are used - check them for such dependencies - plugins that communicate with a large backend systems, perform security pinning, etc. may have such dependency.

I hope that this helps.

Regards,
Anton Dobrev
Telerik

 

 

[David]

Anton,

I am using Everlive for PushNotifications.  When I tried using your temporary SDK that omitted the SSLmodule I was unable to get the app to run.  The version with the latest Bower component of Everlive did run fine on both the Simulator and as a beta in the Android Play store.  However when I replaced the bower component files everlive.all files, I cannot get the simulator to run.  It gives the error:

Uncaught Error: Cannot find module 'node-cryptojs-aes' at bower_components/everlive/min/everlive.all.min.js (line: 26)
Uncaught ReferenceError: Everlive is not defined at app.js (line: 125)

Maybe I am not installing your temporary version correctly.

When my latest working Beta is in Android store, I am not seeing any warning, however I would need to promote to production to truly see if it is clear of the problem.  My thought is that Google is running the scans of the APK looking for the phrase OpenSSL to determine if the app has the issue and they are only scanning production not beta apps.

I have attached a screen shot showing the Plugins, and the Solutions Explorer shows only the Everlive in the Bower Components.

I am using Kendo.UI.Core version "2016.1.112 Verified". 

Here is the link for the Warning Message about the OpenSSL ... https://support.google.com/faqs/answer/6376725

Is there a way to get a version of the Everlive SDK with the name "OpenSSL" changed slightly so it does not trigger the grep that Google does on the apk file. Also, please provide detailed instructions on how to install the SDK from the zip provided.

Does the Crypto library referenced in Everlive SDK actually use OpenSSL?  If so, which version?

Thank you in advance for your prompt help.  The deadline is approaching fast.

Thanks,

David

[Anton Dobrev]

Hello David,

As to your questions.

The SDK attached in my previous reply was not correctly built without this dependency and hence the error. I would like to offer my apologies for the same. Please find attached the SDK that should function correctly without the cryptography libraries.

You can import the files simply by importing the folder in your project and referencing the desired version of the SDK in your code.

The Everlive SDK utilizes the node-cryptojs-aes  module for some cryptography functions but does not have a dependency to OpenSSL. It also utilizes the Crypto JS module for the same. Both libraries have methods for interoperability with OpenSSL but to our awareness do not utilize the OpenSSL module though the term OpenSSL is used in a bunch of methods. .

The attached version of the SDK does not contain any of the modules so you can test with it.

I hope that this helps.

Regards,
Anton Dobrev
Telerik

 

 

[David]

I rebuilt with the special Everlive SDK and posted to my Beta test.  After several hours, an alert showed up that it still had the OpenSSL security vulnerability.  So I removed out all my plugins except for Push Notifications, rebuilt and published to Beta test.  After waiting many hours, I did not see any alert regarding that APK version.  Same when I added back the Telerik plugin for Spinner Dialog.

So that narrows it down to the Telerik plugin for Mapbox version 1.1.1 was the plugin most likely causing the problem.  I see a newer version is available, but since I changed to using Google maps instead of Mapbox, I will not be reinstalling the Mapbox plugin.

One last test that I am conducting is to reinstall the full latest version of the Everlive SDK and publishing that to my Beta test.  Hopefully that version will pass their OpenSSL vulnerability test.  I still need to give it some time for Google to scan the APK and issue the alert, if any.  I will post if this latest version gets flagged, otherwise we will assume it is Mapbox.

Thanks,

David

[Anton Dobrev]

Hi David,

Glad that your investigation was fruitful and hopefully it will lead to resolving the issue.

Let me know of the final results and should you have further questions or considerations.

Regards,
Anton Dobrev
Telerik by Progress

 

 

[Amit]

Application rejection due to OpenSSL

 

 

I tried to upload application on Play Store but the app got rejected and I got mail from Google Play with following issue:

[![enter image description here][1]][1]

I used many libraries, jars, external projects and dependencies in my app are. 

    dependencies {
        compile fileTree(include: ['*.jar'], dir: 'libs')
        compile project(':videorecording')
        compile project(':cropper')
        compile('com.crashlytics.sdk.android:crashlytics:2.6.5@aar') {
            transitive = true;
        }
        compile('com.twitter.sdk.android:twitter:1.7.2@aar') {
            transitive = true;
        }
     
        compile project(':recorder')
        compile 'com.pnikosis:materialish-progress:1.5'
        compile 'com.timehop.stickyheadersrecyclerview:library:0.4.3'
        compile 'com.oguzdev:CircularFloatingActionMenu:1.0.2'
        compile 'com.kyleduo.switchbutton:library:1.2.8'
        compile 'com.google.android.gms:play-services-gcm:8.4.0'
        compile 'com.google.android.gms:play-services-location:8.4.0'
        compile 'com.baoyz.swipemenulistview:library:1.2.1'
        compile 'com.splunk.mint:mint:4.4.0'
        compile 'com.google.android.exoplayer:exoplayer:r1.5.4'
        compile 'it.sephiroth.android.library.targettooltip:target-tooltip-library:+'
        compile project(':uploadservice')
    }


I searched a lot on google and got to know that I need to update OpenSSL version. I don't know how to update OpenSSL or which library in my project uses OpenSSL.

  [1]: https://i.stack.imgur.com/BYLKr.jpg

[Amit]

Application rejection due to OpenSSL




I tried to upload application on Play Store but the app got rejected and I got mail from Google Play with following issue:



I used many libraries, jars, external projects and dependencies in my app are. 

    dependencies {
        compile fileTree(include: ['*.jar'], dir: 'libs')
        compile project(':videorecording')
        compile project(':cropper')
        compile('com.crashlytics.sdk.android:crashlytics:2.6.5@aar') {
            transitive = true;
        }
        compile('com.twitter.sdk.android:twitter:1.7.2@aar') {
            transitive = true;
        }
     
        compile project(':recorder')
        compile 'com.pnikosis:materialish-progress:1.5'
        compile 'com.timehop.stickyheadersrecyclerview:library:0.4.3'
        compile 'com.oguzdev:CircularFloatingActionMenu:1.0.2'
        compile 'com.kyleduo.switchbutton:library:1.2.8'
        compile 'com.google.android.gms:play-services-gcm:8.4.0'
        compile 'com.google.android.gms:play-services-location:8.4.0'
        compile 'com.baoyz.swipemenulistview:library:1.2.1'
        compile 'com.splunk.mint:mint:4.4.0'
        compile 'com.google.android.exoplayer:exoplayer:r1.5.4'
        compile 'it.sephiroth.android.library.targettooltip:target-tooltip-library:+'
        compile project(':uploadservice')
    }


I searched a lot on google and got to know that I need to update OpenSSL version. I don't know how to update OpenSSL or which library in my project uses OpenSSL.

[Anton Dobrev]

@Amit

I'd suggest that you examine the link in the mail (which I suppose is the one from here) and ensure that you have checked for any strings (as in the article) about OpenSSL in your app package.

Also, ensure that you have updated to a more recent version of the installed dependencies.

Also, you may consider removing the dependencies one by one until the suspect for this error is isolated.

Regards,
Anton Dobrev
Telerik by Progress