How to update OpenSSL?

[Ivan Acevedo]

Hi.

I have a problem uploading my apk to google play, I get this message:

OpenSSL was detected in the 1501

Your app uses an OpenSSL version that contains a security vulnerability. Check out this Google Help Center article for more information, including the deadline for resolving the vulnerability.

How can I update openssl to upload my application?

[Alexander Taylor]

Are you building with `buildozer android_new debug`? I thought this was fixed in the python-for-android master branch, which that command would use. It may never have been fixed in the old toolchain.

[Ivan Acevedo]

Yes, I'm using `buildozer android_new debug`

[ZenCODE]

When did you last update and rebuild? We got this and fixed it on the old toolchain (https://github.com/kivy/python-for-android/commit/447cea28b982fb0c8b4d9ea044a8977f2ca65350).

This is the same version (1.0.2h) as the new toolchain (android_new) and the app was accepted. It does fix that vulnerability they are flagging (heartbleed I think). So please:

1. post the exact version of openssl your app is shipping with.
2. The complete rejection message. Our message from google did specify exactly which version fixes the vulnerability in question.

Peace

[Ivan Acevedo]

Every time I upload my apk I get this message:

Vulnerability	APK Version(s)
OpenSSL The vulnerabilities were addressed in OpenSSL 1.0.2f/1.0.1r. To confirm your OpenSSL version, you can do a grep search for: \$ unzip -p YourApp.apk | strings | grep "OpenSSL" You can find more information and next steps in this Google Help Center article.	1504

I'm using "android_new" and add "openssl" to the list of requirements, and the version is 1.0.2h.

I have executed this command: unzip -p YourApp.apk | Strings | Grep "OpenSSL"

And gives me this result:

OpenSSLDie

DH_OpenSSL

DSA_OpenSSL

ECDSA_OpenSSL

ECDH_OpenSSL

UI_OpenSSL

OpenSSL 1.0.2h  3 May 2016

%s(%d): OpenSSL internal error, assertion failed: %s

OpenSSL DH Method

OpenSSL X9.42 DH method

OpenSSL PKCS#3 DH method

OpenSSL CMAC method

OpenSSL HMAC method

OpenSSL EC algorithm

OpenSSL RSA method

OpenSSL DSA method

OpenSSL ECDSA method

OpenSSL ECDH method

You need to read the OpenSSL FAQ, http://www.openssl.org/support/faq.html

OpenSSL default

OpenSSL default user interface

SSLv3 part of OpenSSL 1.0.2h  3 May 2016

TLSv1 part of OpenSSL 1.0.2h  3 May 2016

nopqrsDTLSv1 part of OpenSSL 1.0.2h  3 May 2016

MD5 part of OpenSSL 1.0.2h  3 May 2016

SHA1 part of OpenSSL 1.0.2h  3 May 2016

SHA-256 part of OpenSSL 1.0.2h  3 May 2016

SHA-512 part of OpenSSL 1.0.2h  3 May 2016

Big Number part of OpenSSL 1.0.2h  3 May 2016

EC part of OpenSSL 1.0.2h  3 May 2016

(1RSA part of OpenSSL 1.0.2h  3 May 2016

Diffie-Hellman part of OpenSSL 1.0.2h  3 May 2016

Stack part of OpenSSL 1.0.2h  3 May 2016

lhash part of OpenSSL 1.0.2h  3 May 2016

EVP part of OpenSSL 1.0.2h  3 May 2016

ASN.1 part of OpenSSL 1.0.2h  3 May 2016

PEM part of OpenSSL 1.0.2h  3 May 2016

X.509 part of OpenSSL 1.0.2h  3 May 2016

DES part of OpenSSL 1.0.2h  3 May 2016

libdes part of OpenSSL 1.0.2h  3 May 2016

AES part of OpenSSL 1.0.2h  3 May 2016

RC2 part of OpenSSL 1.0.2h  3 May 2016

IDEA part of OpenSSL 1.0.2h  3 May 2016

CAMELLIA part of OpenSSL 1.0.2h  3 May 2016

EDSA part of OpenSSL 1.0.2h  3 May 2016

ECDSA part of OpenSSL 1.0.2h  3 May 2016

ECDH part of OpenSSL 1.0.2h  3 May 2016

RAND part of OpenSSL 1.0.2h  3 May 2016

CONF part of OpenSSL 1.0.2h  3 May 2016

CONF_def part of OpenSSL 1.0.2h  3 May 2016

TXT_DB part of OpenSSL 1.0.2h  3 May 2016

RC4 part of OpenSSL 1.0.2h  3 May 2016

OpenSSLDie

DSA_OpenSSL

ECDSA_OpenSSL

DH_OpenSSL

ECDH_OpenSSL

OpenSSL_add_all_ciphers

OpenSSL_add_all_digests

UI_OpenSSL

%s(%d): OpenSSL internal error, assertion failed: %s

OpenSSL 1.0.2h  3 May 2016

OpenSSL HMAC method

OpenSSL EC algorithm

OpenSSL RSA method

OpenSSL DSA method

OpenSSL ECDSA method

OpenSSL DH Method

OpenSSL X9.42 DH method

OpenSSL PKCS#3 DH method

OpenSSL ECDH method

You need to read the OpenSSL FAQ, http://www.openssl.org/support/faq.html

OpenSSL default

OpenSSL default user interface

OpenSSL CMAC method

MD4 part of OpenSSL 1.0.2h  3 May 2016

MD5 part of OpenSSL 1.0.2h  3 May 2016

SHA part of OpenSSL 1.0.2h  3 May 2016

SHA1 part of OpenSSL 1.0.2h  3 May 2016

SHA-256 part of OpenSSL 1.0.2h  3 May 2016

SHA-512 part of OpenSSL 1.0.2h  3 May 2016

RIPE-MD160 part of OpenSSL 1.0.2h  3 May 2016

DES part of OpenSSL 1.0.2h  3 May 2016

libdes part of OpenSSL 1.0.2h  3 May 2016

 !"#$% !"#$%&'()*+,-./0123456789:;<=>?@ABCD./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzAES part of OpenSSL 1.0.2h  3 May 2016

RC2 part of OpenSSL 1.0.2h  3 May 2016

RC4 part of OpenSSL 1.0.2h  3 May 2016

IDEA part of OpenSSL 1.0.2h  3 May 2016

:Blowfish part of OpenSSL 1.0.2h  3 May 2016

\CAST part of OpenSSL 1.0.2h  3 May 2016

OCAMELLIA part of OpenSSL 1.0.2h  3 May 2016

Big Number part of OpenSSL 1.0.2h  3 May 2016

EC part of OpenSSL 1.0.2h  3 May 2016

(1RSA part of OpenSSL 1.0.2h  3 May 2016

ggenDSA part of OpenSSL 1.0.2h  3 May 2016

ECDSA part of OpenSSL 1.0.2h  3 May 2016

Diffie-Hellman part of OpenSSL 1.0.2h  3 May 2016

ECDH part of OpenSSL 1.0.2h  3 May 2016

Stack part of OpenSSL 1.0.2h  3 May 2016

lhash part of OpenSSL 1.0.2h  3 May 2016

RAND part of OpenSSL 1.0.2h  3 May 2016

EVP part of OpenSSL 1.0.2h  3 May 2016

ASN.1 part of OpenSSL 1.0.2h  3 May 2016

PEM part of OpenSSL 1.0.2h  3 May 2016

X.509 part of OpenSSL 1.0.2h  3 May 2016

CONF part of OpenSSL 1.0.2h  3 May 2016

CONF_def part of OpenSSL 1.0.2h  3 May 2016

TXT_DB part of OpenSSL 1.0.2h  3 May 2016

Returns 1 if the OpenSSL PRNG has been seeded with enough data and 0 if not.

Mix string into the OpenSSL PRNG state.  entropy (a float) is a lower

I do not know what to do, how can I solve this?

[ZenCODE]

Bizarre. It looks like you've got the right version but google is not picking that up. I would suggest the following:

1. Check that it works. The "%s(%d): OpenSSL internal error, assertion failed: %s" line is worrying. Test that your APK works i.e. install it, and check that openssl actually works.

2. If so, contact google and point out that your openssl does fit the requirements. It could be a glitch on their side when scanning.

Please keep us posted of developments...:-)

Cheers



[Ivan Acevedo]

I found the problem, it is the "_ssl.so" file that I use to make the raven (Sentry) library work. Without that file it does not work, because the error "No module named _ssl" appears. Apparently that file is outdated. How can I get that updated file? Or how can I compile it to a newer version? Or how else can I make raven work?

[Alexander Taylor]

What _ssl.so file? The one in Python itself? If so, it sounds like
you've compiled against the old version, not the new one.

> --
> You received this message because you are subscribed to a topic in the
> Google Groups "Kivy users support" group.
> To unsubscribe from this topic, visit
> https://groups.google.com/d/topic/kivy-users/D9Nb_MYsT0s/unsubscribe.
> To unsubscribe from this group and all its topics, send an email to
> kivy-users+...@googlegroups.com
> <mailto:kivy-users+...@googlegroups.com>.
> For more options, visit https://groups.google.com/d/optout.

[Ivan Acevedo]

If exactly the python _ssl.so is added to the "lib-dynload" folder.

How do I compile the new version?

[Alexander Taylor]

This is discussed at https://github.com/kivy/buildozer/issues/332 . I
made a PR to update the downloaded version in the old toolchain, but
havent' tested it.

On 04/03/17 14:26, Ivan Acevedo wrote:
> If exactly the python _ssl.so is added to the "lib-dynload" folder.
> How do I compile the new version?
>

[Ivan Acevedo]

I have solved the problem.

Unfortunately OpenSSL does not work with raven using "android_new".

Solve it as follows:

1) I compiled the application using "buildozer android debug" (old toolchain). Adding to the requirements: raven and openssl.

2) At the end of compiling (the apk compiles with version 1.0.2h of openssl), I searched for the file "_ssl.so" inside the folder: .buildozer.

3) Copy this file and place it in the project folder like this: lib/python2.7/lib-dynload/_ssl.so

And with that raven works perfectly and google play accepts the application.

Thank you very much for your help :D