[FLEX-28988] Flex 4.5.1A framework RSL has invalid digest, get Flex Error #1001: Digest mismatch with RSL

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: Adobe Flex SDK Previous
• Component/s: Runtime Shared Libraries
• Environment: Affected OS(s): All OS Platforms; Affected OS(s): All OS Platforms; Browser: Other (specify version); Language Found: English
• Assignee: Unassigned
• Reporter: Adobe JIRA
• Created: 05/Dec/11 19:39
• Updated: 05/Dec/11 19:39

Description

Steps to reproduce:
1. Install 4.5.1A (4.5.1.21328A) as outlined in the tech note for https://www.adobe.com/support/security/bulletins/apsb11-25.html at http://kb2.adobe.com/cps/915/cpsid_91544.html. Direct link to SDK is http://www.adobe.com/go/flexsdk45securitybuild.
2. Build an app (I use ant, FB does not verify digests by default) that verifies digests and loads the framework_4.5.1.21489.swf RSL.

Actual Results:
Flex Error #1001: Digest mismatch with RSL when trying to load the framework RSL

Expected Results:
Should load fine. If you unzip framework.swc you'll notice the sha256 digest in catalog.xml does not match the sha256 digest of the unsigned RSL itself.

Workaround (if any):
In mxmlc ant task, specify verify-digests="false"