Thanks for the prompt reply, Eric. Typically, how much advance warning would a developer receive before their app is blocked? Also, if we believe that this vulnerability doesn't affect our applications, is there a process that we can follow with Google to ensure that the app is safe without upgrading the library?
We are currently working to upgrade Cordova for our next release, but we have a large number of apps on Google play and it will take us a while to upgrade and test them all. Thanks again, Campbell On Thursday, 2 October 2014 18:04:47 UTC+13, Eric Davis wrote: > > Hi Campbell, > > Thanks for your post. While it's unclear whether the issues affect every > app that's using pre-3.5.1 versions of Apache Cordova, we're trying to help > developers stay up to date on all security patches. Even if you think that > specific issues may not be relevant, it's good practice to update any > libraries in your app that have known issues. We want you to have time to > update now, but eventually, to help protect users we may need to block apps > that have out of date dependent libraries or other vulnerabilities. > > Best, > > - Eric > Android Security Team > On Wednesday, October 1, 2014 2:24:54 PM UTC-7, Campbell Moss wrote: >> >> The company I work for develops apps based on Apache Cordova. We recently >> started receiving the following email: >> >> *From:* Google Play Developer Support [ >> mailto:[email protected]] >> *Sent:* Wednesday, October 01, 2014 11:49 AM >> *To:* >> *Subject:* Security Alert: Apache Cordova vulnerabilities in your Google >> Play app >> >> *Sent:* Wednesday, October 01, 2014 11:49 AM >> >> *To:* >> >> *Subject:* Security Alert: Apache Cordova vulnerabilities in your Google >> Play app >> >> This is a notification that your com.x.tablet, is built on a version of >> Apache Cordova that contains security vulnerabilities. This includes a high >> severity cross-application scripting (XAS) vulnerability. Under certain >> circumstances, vulnerable apps could be remotely exploited to steal >> sensitive information, such as user login credentials. >> >> *You should upgrade to Apache Cordova 3.5.1 or higher as soon as >> possible.* For more information about the vulnerabilities, and for >> guidance on upgrading Apache Cordova, please see >> http://cordova.apache.org/announcements/2014/08/04/android-351.html >> <http://www.google.com/appserve/mkt/p/KmKdvQON6CTeZllUj7WYD83Vn9mvaw8PPuE7s-iye9mMdMg4vanAFar-c-4del1W5NMHLsvG9v08xwXupuZE5UFefpQMCEV-U7lC2BbIRTZlfP5k> >> . >> >> *Please note, applications with vulnerabilities that expose users to risk >> of compromise may be considered “dangerous products” and subject to removal >> from Google Play.* >> >> Regards, >> >> Google Play Team >> >> >> We were aware of this vulnerability, and during our investigation have >> determined that our apps are not vulnerable as they don't use the intent >> filter that permits the exploit. >> >> My question is, will Google be removing all apps that use older versions >> of Cordova from Google Play? >> > -- You received this message because you are subscribed to the Google Groups "Android Security Discussions" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at http://groups.google.com/group/android-security-discuss. For more options, visit https://groups.google.com/d/optout.
