3 ms·
What is the timeframe where setting up TOTP is vulnerable? I haven't been able to find an indication of how long this bug has been in production.
by infinite8s 10y ago
What is the timeframe where setting up TOTP is vulnerable? I haven't been able to find an indication of how long this bug has been in production.
- et-al 10y agoCloudflare shares a timeline on their blog post: The three features implicated were rolled out as follows. The earliest date memory could have leaked is 2016-09-22. 2016-09-22 Automatic HTTP Rewrites enabled 2017-01-30 Server-Side Excludes migrated to new parser 2017-02-13 Email Obfuscation partially migrated to new parser 2017-02-18 Google reports problem to Cloudflare and leak is stopped The greatest potential impact occurred for four days starting on February 13 because Automatic HTTP Rewrites wasn’t widely used and Server-Side Excludes only activate for malicious IP addresses. https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/ https://blog.cloudflare.com/incident-report-on-memory-leak-c...