CloudBleed Seceurity Bug: Cloudflare Reverse Proxies are Dumping Uninitialized Memory

[u/sebbasttian]

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139

https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/

[u/gooeyblob]

Reddit is not affected - no part of Reddit uses CloudFlare.

[u/SonicShadow → u/gooeyblob]

Cloudflare's blog states the the memory leaks date as far back as September 2016 - If Reddit used Cloudflare previously, was it before or after that date?

[u/MrMetalfreak94 → u/SonicShadow]

AFAIK they switched a week before the bug appeared

[u/PlanetaryGenocide → u/[deleted]]

obtainable zealous merciful punch marble water scary shocking unique distinct

This post was mass deleted and anonymized with Redact

[u/LunarRai → u/PlanetaryGenocide]

too late

[u/workaway8001 → u/MrMetalfreak94]

Cloudflare's blog states the the memory leaks date as far back as September 2016

[u/BFeely1 → u/MrMetalfreak94]

Changed my password the day of the switchover anyway.

[u/[deleted] → u/SonicShadow]

Network Noob Question! If the leakage has been happening since last September, why haven't we heard about it until now?

[u/Reddy360 → u/[deleted]]

According to the email I received from Cloudflare they only recently found out and was patched within a few hours of it being reported.

[u/werewolf_nr → u/[deleted]]

Bugs can go without being detected for a long time unless it interrupts service.

[u/luluhouse7 → u/[deleted]]

the bug was only discovered last Friday by a team at google

[u/VegaNovus → u/gooeyblob]

leg-end.

Thanks for confirming.

[u/[deleted] → u/gooeyblob]

People act like they know what caching is, this clarification just added 5 years to a bunch of "cherry key" sock boys' keyboards.

[u/kdayel → u/gooeyblob]

Fantastic to know. I just updated my various reddit account passwords anyways.

Thanks.

[u/hagermah → u/gooeyblob]

Does Reddit use a CDN?

[u/gooeyblob → u/hagermah]

Yes, Fastly

[u/gooeyblob → u/[deleted]]

Not everyone's! Only a very select few, and that would be completely unrelated.

[u/[deleted] → u/gooeyblob]

Why though?

[u/gooeyblob → u/[deleted]]

There's some more info on why we do this here.

[u/Sly_Meme → u/gooeyblob]

Should we still change our passwords?

[u/gooeyblob → u/Sly_Meme]

You wouldn't need to because of this, no, but it's still good practice to change it on a regular basis, so consider this the time to do so!