Regarding your app is statically linking against a version of OpenSSL

Question

I have uploaded my production apk file about one month ago. But, now i am getting a warning on apk section(or Alert section) of my Google play developer console.

Security alert

Your app is statically linking against a version of OpenSSL that has multiple security vulnerabilities. You should update OpenSSL as soon as possible.

The vulnerabilities were addressed in OpenSSL versions beginning with 1.0.1h, 1.0.0m, and 0.9.8za. To confirm your OpenSSL version, you can do a grep via ("$ unzip -p YourApp.apk | strings | grep "OpenSSL""). For more information about the vulnerability, please consult http://www.openssl.org/news/secadv_20140605.txt.

To confirm that you've upgraded correctly, upload the updated version to the Developer Console and check back after five hours.

Please note, while it's unclear whether these specific issues affect your application, applications with vulnerabilities that expose users to risk of compromise may be considered "dangerous products" and subject to removal from Google Play.

How to fix it?Please help me. I am scared by last line.

"may be considered "dangerous products" and subject to removal from Google Play."

Thanks in advance.

`You should update OpenSSL as soon as possible.` And you should ask _how to update OpenSSL in Android_ with more information about your development environment. — Paco Abato, Dec 19 '14 at 12:17
"And i can't figure out where am I using OpenSSL" -- it would be coming from an AAR or Android library project, most likely. — CommonsWare, Dec 19 '14 at 13:16
Is my question not clear.I am confused.why i am getting down voting.. — SRB Bans, Dec 20 '14 at 08:29
Possible duplicate of [Google Play OpenSSL warning message](http://stackoverflow.com/questions/24197777/google-play-openssl-warning-message) — jww, May 29 '15 at 23:20

score 1 · Accepted Answer · 2015-08-18T11:29:55.763

1

change the extension of .apk to .zip and Use the serch file for windows and search for the String "openssl" it will show you the exact version of openssl.

edited Aug 18 '15 at 11:29

answered Aug 18 '15 at 11:23

score 0 · Answer 2 · answered Dec 30 '14 at 19:35

According to some Google forums, here is what they suggest you do:

(1) You can determine which apps are using OpenSSL via ("$ unzip -p YourApp.apk | strings | grep "OpenSSL"") (2) Please update all statically linked versions of OpenSSL to 1.0.1h, 1.0.0m, or 0.9.8za. (3) If you are using a 3rd party library that bundles OpenSSL, please notify the 3rd party and work with them to address this.

Hope this helps.

Regarding your app is statically linking against a version of OpenSSL

2 Answers2