Android Play store openSSL warning

Question

I have recently uploaded an apk to play store and my app was rejected stating that there were some openSSL vulnerabilities.

I'm using Apache HTTP client for making call to the server. Below is the list of libraries/dependencies I'm using in my app

useLibrary 'org.apache.http.legacy'

dependencies {
    compile files('libs/acra-4.6.1.jar')
    compile files('libs/httpmime-4.1.2.jar')
    compile files('libs/library-1.2.1.jar')
    compile files('libs/universal-image-loader-1.9.3.jar')
    compile files('libs/nineoldandroids-2.4.0.jar')
    compile('com.crashlytics.sdk.android:crashlytics:2.5.5@aar') {
        transitive = true;
    }
    compile project(':signalrlibrary')
    compile 'com.koushikdutta.ion:ion:2.1.7'
    compile 'com.twilio:client-android:1.2.18'
    compile 'com.twilio:conversations-android:0.12.2'
    compile 'com.google.code.gson:gson:2.5'
    compile 'joda-time:joda-time:2.2'
    compile 'com.google.firebase:firebase-messaging:9.6.1'
    compile 'com.android.support:appcompat-v7:23.1.1'
    compile 'com.android.support:design:23.1.1'
    compile files('libs/PdfViewer.jar')
}

SignalR is an instant messaging SDK for Android.

Could some one help me out to check which library has the old openSSL? Any help is much appreciated.

Here are the logs that I got when I do a grep on the apk file:

OpenSSL 1.0.1k 8 Jan 2015
%s(%d): OpenSSL internal error, assertion failed: %s
OpenSSL DH Method
OpenSSL CMAC method
OpenSSL HMAC method
OpenSSL EC algorithm
OpenSSL RSA method
OpenSSL DSA method
OpenSSL ECDSA method
OpenSSL PKCS#3 DH method
OpenSSL ECDH method
You need to read the OpenSSL FAQ, http://www.openssl.org/support/faq.html
OpenSSL default
OpenSSL default user interface
OpenSSL 'dlfcn' shared library method
SSLv2 part of OpenSSL 1.0.1k 8 Jan 2015
SSLv3 part of OpenSSL 1.0.1k 8 Jan 2015
TLSv1 part of OpenSSL 1.0.1k 8 Jan 2015
MD5 part of OpenSSL 1.0.1k 8 Jan 2015
SHA1 part of OpenSSL 1.0.1k 8 Jan 2015
SHA-256 part of OpenSSL 1.0.1k 8 Jan 2015
SHA-512 part of OpenSSL 1.0.1k 8 Jan 2015
Big Number part of OpenSSL 1.0.1k 8 Jan 2015
EC part of OpenSSL 1.0.1k 8 Jan 2015
^RSA part of OpenSSL 1.0.1k 8 Jan 2015
Diffie-Hellman part of OpenSSL 1.0.1k 8 Jan 2015
Stack part of OpenSSL 1.0.1k 8 Jan 2015
lhash part of OpenSSL 1.0.1k 8 Jan 2015
EVP part of OpenSSL 1.0.1k 8 Jan 2015
ASN.1 part of OpenSSL 1.0.1k 8 Jan 2015
PEM part of OpenSSL 1.0.1k 8 Jan 2015
X.509 part of OpenSSL 1.0.1k 8 Jan 2015
DES part of OpenSSL 1.0.1k 8 Jan 2015
libdes part of OpenSSL 1.0.1k 8 Jan 2015
AES part of OpenSSL 1.0.1k 8 Jan 2015
RC2 part of OpenSSL 1.0.1k 8 Jan 2015
IDEA part of OpenSSL 1.0.1k 8 Jan 2015
CAMELLIA part of OpenSSL 1.0.1k 8 Jan 2015
EDSA part of OpenSSL 1.0.1k 8 Jan 2015
ECDSA part of OpenSSL 1.0.1k 8 Jan 2015
ECDH part of OpenSSL 1.0.1k 8 Jan 2015
RAND part of OpenSSL 1.0.1k 8 Jan 2015
CONF part of OpenSSL 1.0.1k 8 Jan 2015
CONF_def part of OpenSSL 1.0.1k 8 Jan 2015
TXT_DB part of OpenSSL 1.0.1k 8 Jan 2015
MD4 part of OpenSSL 1.0.1k 8 Jan 2015
SHA part of OpenSSL 1.0.1k 8 Jan 2015
RIPE-MD160 part of OpenSSL 1.0.1k 8 Jan 2015
RC4 part of OpenSSL 1.0.1k 8 Jan 2015
:Blowfish part of OpenSSL 1.0.1k 8 Jan 2015
\CAST part of OpenSSL 1.0.1k 8 Jan 2015

Hello Google Play Developer, We rejected AppName, with package name com.app.login, for violating our Malicious Behavior or User Data policy. If you submitted an update, the previous version of your app is still available on Google Play. This app uses software that contains security vulnerabilities for users or allows the collection of user data without proper disclosure. Below is the list of issues and the corresponding APK versions that were detected in your recent submission. Please upgrade your app(s) as soon as possible and increment the version number of the upgraded APK. — traj, Nov 22 '16 at 07:50
Security alert Your app is using a version of OpenSSL containing a security vulnerability. Please see this Google Help Center article for details, including the deadline for fixing the vulnerability. — traj, Nov 22 '16 at 07:51
try script provided in this link - http://stackoverflow.com/questions/24197777/google-play-and-openssl-warning-message & — Amod Gokhale, Nov 22 '16 at 10:31
@AmodGokhale I have got a long list of output after runnig the script in the suggested link, which primarily has ssl in every line. I cant post it here. — traj, Nov 23 '16 at 10:09
please update your question with logs and you don't need to worry about all openSSL's. only one which is out dated — Amod Gokhale, Nov 23 '16 at 11:01
doing a grep on apk returned only 2 versions of openSSL, OpenSSL 1.0.1s 1 Mar 2016 and OpenSSL 1.0.1k 8 Jan 2015 — traj, Nov 23 '16 at 13:59

Android Play store openSSL warning

0 Answers0