GooglePlay Security Alert X509TrustManager

Unity Engine
,
1

I just logged into the Google Play App Console and see all my Unity apps flagged with a yellow warning symbol.

Security alert

Your app is using an unsafe implementation of the X509TrustManager interface to an Apache HTTP client, resulting in a security vulnerability. Please see this Google Help Center article for details, including the deadline for fixing the vulnerability.

The link is: How to fix apps containing an unsafe implementation of TrustManager - Google Help

The deadline is May 17, 2016 to correct the problem or have GooglePlay block publishing of any new apps or updated containing the unsafe implementation.

I have this warning in paid apps with no advertising plug ins and free apps with third party plugins. Does anyone have anymore information about how to correct this?

2

Getting the same issue on one of ours. Did you get any further with this?

3

We also are getting this notification. Any information would be appreciated.

4

I’m facing this issue as well.
Are you guys using something like this to do HTTPS requests?

ServicePointManager.ServerCertificateValidationCallback += AcceptAllCertifications;

public bool AcceptAllCertifications(object sender,
        System.Security.Cryptography.X509Certificates.X509Certificate certification,
        System.Security.Cryptography.X509Certificates.X509Chain chain,
        System.Net.Security.SslPolicyErrors sslPolicyErrors)
{
    return true;
}

Other probably source of this problem should be plugins:
I’m using:

  • Flurry
  • Localytics
  • Branch
  • Facebook
  • Apsalar
  • Fabrik Crashlytics
  • Adjust
5

Hey guys, any new about this issue?
Which version of Unity are u guys using?

edit:
I think that I found the problem in our app. It was due an old version of Flurry SDK:
“The presence of this vulnerability was communicated to the Flurry developers. They acknowledged the vulnerability was addressed starting in version 3.4 of the ad library.”
Source: https://www.fireeye.com/blog/threat-research/2014/08/ssl-vulnerabilities-who-listens-when-android-applications-talk.html

There is some devs that resolved this issue by updating flurry plugin:

6

I don’t use Flurry SDK though, and I’m having the same problem. please help