You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cordova.apache.org by bo...@apache.org on 2015/05/27 17:58:43 UTC
svn commit: r1682067 - /cordova/site/www/_posts/2015-05-26-android-402.md
Author: bowserj
Date: Wed May 27 15:58:43 2015
New Revision: 1682067
URL: http://svn.apache.org/r1682067
Log:
CVE-2015-1835 announcement
Added:
cordova/site/www/_posts/2015-05-26-android-402.md
Added: cordova/site/www/_posts/2015-05-26-android-402.md
URL: http://svn.apache.org/viewvc/cordova/site/www/_posts/2015-05-26-android-402.md?rev=1682067&view=auto
==============================================================================
--- cordova/site/www/_posts/2015-05-26-android-402.md (added)
+++ cordova/site/www/_posts/2015-05-26-android-402.md Wed May 27 15:58:43 2015
@@ -0,0 +1,51 @@
+---
+layout: post
+author:
+ name: Joe Bowser
+ url: https://twitter.com/infil00p
+title: "Apache Cordova Android 4.0.2 and 3.7.2 released"
+categories: announcements
+tags: news releases security
+---
+
+
+A major Security issue were discovered in the Android platform of Cordova. We are releasing version 4.0.2 of Cordova Android to address these security issues. We recommend that all Android applications built using Cordova 4.0.x or higher be upgraded to use version 4.0.2 of Cordova Android. If you are using an older version of Cordova, we have also released 3.7.2 with the same fix, and we recommend that you at upgrade your project to either of these fixed versions. Other Cordova platforms such as iOS are unaffected, and do not have an update.
+
+When using the Cordova CLI, the command to use 4.0.2 of Cordova Android is:
+
+ cordova platform add android@4.0.2 --usenpm
+
+and the command to use 3.7.2 is:
+
+ cordova platform add android@3.7.2 --usenpm
+
+The security issue is CVE-2015-1835
+
+For your convenience, the text of the CVE is included here.
+
+<!--more-->
+
+____
+
+CVE-2015-1835: Remote exploit of secondary configuration variables in Apache Cordova on Android
+
+
+Severity: High
+
+Vendor:
+The Apache Software Foundation
+
+Versions Affected:
+Cordova Android versions up to 4.0.1 (3.7.2 Excluded)
+
+Description:
+Android applications built with the Cordova framework that don't have explicit values set in Config.xml can have undefined configuration variables set by Intent. This can cause unwanted dialogs appearing in applications and changes in the application behaviour that can include the app force-closing.
+
+The latest release of Cordova Android entirely removes the ability of configuration parameters to be set by intents. This change is an API change in the platform, and third-party plugins that use values set in the config.xml should make sure that they use the preferences API instead of relying on the Intent bundle, whcih can be manipulated in this case.
+
+Upgrade path:
+Developers who are concerned about this should rebuild their applications with Cordova Android 4.0.2. Developers unable to upgrade to 4.0.2 also have the option of upgrading to Cordova Android 3.7.2. Developers should also make sure that variables that they wish to have protected are specified in their config.xml.
+
+Credit:
+This issue was discovered by Seven She from TrendMicro Mobile Threat Research Team (TRT)
+==================================================
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cordova.apache.org
For additional commands, e-mail: commits-help@cordova.apache.org