The important bit, if you have to decide on patching emergency: OpenSSL has classified this vulnerability as "low severity", which we agree with. In order to m

The important bit, if you have to decide on patching emergency: OpenSSL has classified this vulnerability as "low severity", which we agree with. In order to mount the attack, the attacker has to be able to run the attack code on the same machine that runs the victim code. CacheBleed is a complex attack and there are much easier-to-exploit vulnerabilities in personal computers that it is unlikely that anyone would use CacheBleed in such an environment. Note that frameworks that embed OpenSSL, such as NodeJS, will need to be upgraded as well. https://groups.google.com/forum/#!topic/nodejs-sec/ORAkxchrT4c https://groups.google.com/forum/#!topic/nodejs-sec/ORAkxchrT...