Play Framework XML External Entity Vulnerability

[James Roper]

A security vulnerability has been found in all stable versions of Play Framework 2.x released before 11 September 2013.

This vulnerability has been fixed for all major stable versions of Play, and fixes can be downloaded here:

http://downloads.typesafe.com/play/2.1.4/play-2.1.4.zip

http://downloads.typesafe.com/play/2.0.7/play-2.0.7.zip

The Play team strongly recommends that all Play users upgrade to one of the above releases of Play.  The changelogs for these versions can be found here:

http://www.playframework.com/changelog

For more details on this vulnerability, please see the vulnerability advisory on the Play website:

http://www.playframework.com/security/vulnerability/20130911-XmlExternalEntity

--

James Roper
Software Engineer

Typesafe – Build reactive apps!
Twitter: @jroper