#1570 ✓ resolved
Alexander Reelsen

Playframework does not pass PCI scans due to dangerous SSL ciphers

Reported by Alexander Reelsen | July 19th, 2012 @ 09:19 AM | in 1.3

We recently failed a scan for PCI compliance (needed in order to be allowed for credit card transactions and such) because the SSL implementation of the play framework was considered vulnerable.

Framework version: 1.2.5
Platform you're using: linux

Reproduction steps:
Runt tools like sslscan against your SSL enabled play application and see it.

Details:
The solution to this problem is to allow the user to specify the ciphers which are enabled in the SSL Engine.
I will do a push request asap.

Comments and changes to this ticket

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.

New-ticket Create new ticket

Create your profile

Help contribute to this project by taking a few moments to create your personal profile. Create your profile »

Play framework

Play makes it easier to build Web applications with Java. It is a clean alternative to bloated Enterprise Java stacks. It focuses on developer productivity and targets RESTful architectures. Learn more on the http://www.playframework.org website.

Source code is hosted on github

Check out our repository at http://github.com/playframework/play

Contributing, creating a patch

Please read the contributor guide

Reporting Security Vulnerabilities

Since all bug reports are public, please report any security vulnerability directly to guillaume dot bort at gmail dot com.

Creating a bug report

Bug reports are incredibly helpful, so take time to report bugs and request features in our ticket tracker. We’re always grateful for patches to Play’s code. Indeed, bug reports with attached patches will get fixed far quickly than those without any.

Please include as much relevant information as possible including the exact framework version you're using and a code snippet that reproduces the problem.

Don't have too much expectations. Unless the bug is really a serious "everything is broken" thing, you're creating a ticket to start a discussion. Having a patch (or a branch on Github we can pull from) is better, but then again we'll only pull high quality branches that make sense to be in the core of Play.

Shared Ticket Bins

Tags

Pages