Incident report on memory leak caused by Cloudflare parser bug

Re:Incident report on memory leak caused by Cloudflare parse... by MattBearman on Friday February 24, 2017 @05:02AM (#13722409)

I'm a Cloudflare (free) customer, and I've had no email or contact of any kind from Cloudflare.

My understanding from reading this and Travis' post is that all Cloudflare customers are affected, is that correct?

[ Parent | on HN ]

Re:Incident report on memory leak caused by Cloudflare parse... by andreasley on Friday February 24, 2017 @05:50AM (#13722570)

Basically yes. If some of your traffic was flowing through a server on which any customer had the vulnerable features enabled, parts of your traffic may have been dumped.

[ Parent | on HN ]

Re:Incident report on memory leak caused by Cloudflare parse... by laithshadeed on Friday February 24, 2017 @05:32AM (#13722511)

No. If you have any of those features enabled Email obfuscation, Server-side Excludes and Automatic HTTPS Rewrites as well as you have an invalid HTML markup. Per their blog post it is 0.00003% of the total requests.

[ Parent | on HN ]

Re:Incident report on memory leak caused by Cloudflare parse... by MattBearman on Friday February 24, 2017 @05:43AM (#13722546)

I thought those were the conditions that caused PII to be included in the HTML response, but the PII could come from any customer as it's a buffer overrun situation. Damn this is confusing

[ Parent | on HN ]