|
2022-06-30 18:29 developer |
|
|
|
Hi Jason, Thanks for information, I will monitor it. thanks. |
|
|
Hi, Jason, The vendor who developed the PushAgent APK has fixed the BTS warning. Could you please run the BTS using following APK? The fixed APK was uploaded test branch named BFX-UA300_5.3.4_BTS_TEST. $ pwd vendor/skb/prebuilts/zinnaworks_push-agent $ git log -1 remotes/skb_prebuilts/BFX-UA300_5.3.4_BTS_TEST commit d78d5b6c0cde189efe40753de0c5f38cb00f6b65 (skb_prebuilts/BFX-UA300_5.3.4_BTS_TEST) Author: 양유식/디바이스개발스쿼드 <yusik.yang@sk.com> Date: Mon Jul 18 20:40:36 2022 +0900 [BPM-3983] Fix the vulnerability - Unsafe HostnameVerifier : Update PushAgent (50.43 - Morpheus Push Library 5.0.0.12) Thank you. |
|
|
Hi Sangmin, I've build the latest code with branch BFX-UA300_5.3.4_BTS_TEST. Please check the attachment (BTS-BFX-UA300-20220719.pdf) The following message is gone, The app com.skb.stbPush found at /system/app/PushAgent/PushAgent.apk is considered vulnerable because it contains an unsafe implementation of the interfaces HostnameVerifier or X509HostnameVerifier, which makes the app vulnerable to network attacks. Thanks, Jason |
|
|
Hi, Jason, Thank you. And, there is one more warning(CVE-2022-20223) which is not exist before, what is this warning? Did you expect it will be gone when the latest security patch is applied? CVE-2022-20223.png (198,119 bytes) |
|
|
Hi Sanmin, Regarding CVE-2022-20223, I am working on it. There is one 2022-07 Security patch in packages/apps/Settings Maybe Google forget to release the same modification in folder packages/apps/TvSettings. I've merged it to packages/apps/TvSettings manually by myself. I just submitted a test image for BTS and I think this warning (CVE-2022-20223) should go away after applying this modification. Thanks, Jason |
|
|
Hi Sanmin, I've fix the warning CVE-2022-20223, The number of warnings has been reduced from 23 to 22. Please check the attachment (19.534.15t2.jpg) 19.534.15t2.jpg (94,304 bytes) |
|
|
Hi, Jason, Thank you. |
|
|
HI Jason, Did you get feedback from SOC ? If you have updates share please. Thanks. |
|
|
Hi Wooshin, I asked at least 2 Soc vendor last Friday, no update yet. There is an ATV bootcamp at the end of July, maybe their TAM is participating in it. I also asked the same question on Synaptics NEW jira, you can monitor the following link, https://synacsm.atlassian.net/servicedesk/customer/portal/173/CSMSKBSBLT-188 |
|
|
Hi All, According to ATV Summit 2022 (Certification section) MBA Policy are not currently enforced on TV. But it will eventually be enforced on TV. Thanks, Jason MBA_1.jpg (73,132 bytes) MBA_2.jpg (30,384 bytes) |
|
|
Hi Jason, Thanks for information. |
- yk.jung ( (ALTech) Younkwang Jung ) developer
