title: Android Vitamio 5.0.0 and vulnerable version of OpenSSL
body: <p>I am using Vitamio 5.0.0 version for my app in Google Play. Today i gat a mail from google. it says "Google Play warning: You are using a vulnerable version of OpenSSL "</p>
  
  <blockquote>
    <p>Hello Google Play Developer,</p>
    
    <p>Your app(s) listed at the end of this email utilize a version of
    OpenSSL that contains one or more security vulnerabilities. If you
    have more than 20 affected apps in your account, please check the
    Developer Console for a full list.</p>
    
    <p>Please migrate your app(s) to OpenSSL 1.02f/1.01r or higher as soon as
    possible and increment the version number of the upgraded APK.
    Beginning July 11, 2016, Google Play will block publishing of any new
    apps or updates that use older versions of OpenSSL. If you’re using a
    3rd party library that bundles OpenSSL, you’ll need to upgrade it to a
    version that bundles OpenSSL 1.02f/1.01r or higher.</p>
    
    <p>The vulnerabilities were addressed in OpenSSL 1.02f/1.01r. The latest
    versions of OpenSSL can be downloaded here. To confirm your OpenSSL
    version, you can do a grep search for ($ unzip -p YourApp.apk |
    strings | grep "OpenSSL").</p>
    
    <p>To confirm you’ve upgraded correctly, submit the updated version to
    the Developer Console and check back after five hours. If the app
    hasn’t been correctly upgraded, we will display a warning.</p>
    
    <p>The vulnerabilities include "logjam" and CVE-2015-3194. The Logjam
    attack allows a man-in-the-middle attacker to downgrade vulnerable TLS
    connections to 512-bit export-grade cryptography. This allows the
    attacker to read and modify any data passed over the connection.
    Details about other vulnerabilities are available here. For other
    technical questions, you can post to Stack Overflow and use the tags
    “android-security” and “OpenSSL.”</p>
    
    <p>While these specific issues may not affect every app that uses
    OpenSSL, it’s best to stay up to date on all security patches. Apps
    with vulnerabilities that expose users to risk of compromise may be
    considered in violation of our Malicious Behavior policy and section
    4.4 of the Developer Distribution Agreement.</p>
    
    <p>Apps must also comply with the Developer Distribution Agreement and
    Developer Program Policies. If you feel we have sent this warning in
    error, contact our policy support team through the Google Play
    Developer Help Center.</p>
    
    <p>Regards,</p>
    
    <p>The Google Play Team</p>
  </blockquote>