Several websites including Indian sites using Cloudflare as their storage or host partner could have been affected due to an internal bug that mistakenly leaked sensitive user data. The company confirmed the data leak in a blog post and said that it put together a special team to fix the bug. The bug was initially spotted by a security analyst from Google’s Project Zero team that looks at spotting vulnerabilities on the Internet. Cloudflare explained that one of its servers “were running past the end of a buffer and returning memory that contained private information…some of that data had been cached by search engines.” A non-geek explanation: a temporary memory location (or cache) located in one of Cloudflare’s server started relaying back data (including sensitive info) after the memory got filled. Since there was no space left to store, it started leaking data to random requesters, and some of this info got listed on search engines. “The greatest period of impact was from February 13 and February 18 with around 1 in every 3,300,000 HTTP requests through Cloudflare potentially resulting in memory leakage (that’s about 0.00003% of requests). The greatest period of impact was from February 13 and February 18 with around 1 in every 3,300,000 HTTP requests through Cloudflare potentially resulting in memory leakage (that’s about 0.00003% of requests),” the company said in the blog post. Websites that may have been affected Note that Cloudflare did not disclose the details of websites and links that were affected. Although a…
