Mailing-List: contact dev-help@cordova.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cordova.apache.org
Received-SPF: pass (athena.apache.org: domain of agrieve@google.com designates
 209.85.214.169 as permitted sender)
MIME-Version: 1.0
Sender: agrieve@google.com
In-Reply-To: 
 <CAOBL_k4fxp=BmUX7qBZPj9dyGrMaZWF-BB=t3uQt+dgrNkgoOA@mail.gmail.com>
References: <0f45f8a3e4044216a15a0d90d51645cf@extprdex03.bentley.com>
 <CAOBL_k4fxp=BmUX7qBZPj9dyGrMaZWF-BB=t3uQt+dgrNkgoOA@mail.gmail.com>
From: Andrew Grieve <agrieve@chromium.org>
Date: Thu, 2 Oct 2014 11:40:48 -0400
Message-ID: 
 <CABiQX1UX0oLhNxT-uo9G7kqX4rtmzwjtbyZEQ0zj5NxQN-Qjbg@mail.gmail.com>
Subject: Re: Cordova Android < 3.5.1 XAS Security Vulnerability -- possibility
 of releasing a 2.7-based patched version
To: dev <dev@cordova.apache.org>, iclelland <iclelland@chromium.org>,
	Joe Bowser <jbowser@adobe.com>
Content-Type: multipart/alternative; boundary=e89a8ff1ce22f338bc050472710d

--e89a8ff1ce22f338bc050472710d
Content-Type: text/plain; charset=UTF-8

That said, the relevant patch is here:

https://github.com/apache/cordova-android/commit/2ab81bc5aeb575fef3657cf48a671607e81ca37d

(Ian / Joe, please correct me if there's more than that)


On Thu, Oct 2, 2014 at 11:29 AM, Joe Bowser <bowserj@gmail.com> wrote:

> No, you should upgrade to 3.5.1.  We have dropped support for Cordova 2.x
> months ago, and we recommend upgrading.
>
> On Thu, Oct 2, 2014 at 7:33 AM, <Steve.Wilson@bentley.com> wrote:
>
> > We have released applications in the Google Play store based on Cordova
> > 2.7.0 and have received notification from Google that these apps are
> > vulnerable to an Android Cordova security issue (
> > http://cordova.apache.org/announcements/2014/08/04/android-351.html).
> >
> > Upgrading to Cordova 3.5.1 would require significant work on our part. Is
> > there any possibility that you can release a patched Cordova Android
> > version based on 2.7 that would fix this security vulnerability?
> >
> > Please let me know whether you think this would be possible on your part.
> > Thank you!
> >
> > Thanks,
> > Steve Wilson
> >
>

--e89a8ff1ce22f338bc050472710d--