OpenSSL vulnerabilities ( OpenSSL 1.02f/1.01r or higher and increment the version number)

cocos2d-x
#1

Google Developer give me the this issue.
This information is intended for developers of apps statically linking against a version of OpenSSL that precedes 1.02f/1.01r. These versions contain security vulnerabilities.

Please migrate your app(s) to OpenSSL 1.02f/1.01r or higher as soon as possible and increment the version number of the upgraded APK. Beginning July 11, 2016, Google Play will block publishing of any new apps or updates that use older versions of OpenSSL. Your published app version will remain unaffected, however any updates to the app will be blocked unless they address this vulnerability.

Note : I am using cocos2d-x v2.x
Please provide the solution ASAP.

#2

Let us tag @zhangxm and ask. We did a blog post about being able to update this yourself: http://blog.cocos2d-x.org/2016/04/openssl-update/

#3

Yep, we will not release new version of v2.x, but we already upgrated CURL, you should upgrade it yourself.

#4

What is the latest version of dependency for v2?

#5

你好，我用的v2.2.6，用了你们的最新的url以及openssl库，但是编译的时候，编译不过去，这是怎么回事呢？

#6

错误提示有：./obj/local/armeabi/curl.a(libcurl_la-curl_ntlm_core.o): in function Curl_ntlm_core_lm_resp:curl_ntlm_core.c(.text.Curl_ntlm_core_lm_resp+0xa0): error: undefined reference to ‘DES_set_odd_parity’
error: undefined reference to ‘DES_set_key’
error: undefined reference to ‘DES_ecb_encrypt’
error: undefined reference to 'DES_set_odd_parity’等，一大堆的错误，找不到对应的函数

#7

@dbljoy1209 CURL break compatibility, you can refer to this PR to fix it.

PS: please use english in future. Thanks.

#8

ok,I have tried it, and change the file “WebSocket.h,WebSocket.cpp” as it,but the same error appear when I compile the android projects by the command “./build_native.sh”.

#9

@dbljoy1209 i tested it when i do the PR, it should work. And many developers succeeded too. Please make sure you changed the correct engine. If it still has issue, i have not idea.

#10

Can it solved the below problem by change the file “WebSocket.h,WebSocket.cpp” and replace the new libcurl? where define ‘DES_set_odd_parity’?
error excample:
“error: undefined reference to ‘DES_set_key’
error: undefined reference to ‘DES_ecb_encrypt’
error: undefined reference to ‘DES_set_odd_parity’
.
.
.
.”