Googleは直してるけどBlueboxの判定方法がそれを見れてないに一票

https://bluebox.com/technical/android-fake-id-vulnerability/
Google Android Security Team members provided us insight that Android L
fixes the vulnerability in a different way, i.e. in a different code location,
so the presence of the prior-vulnerable code in JarUtils is a red herring.