Comment by hatthew
7 hours ago
I feel like normal security issues don't get much publicity. The PHP and eMudhra issues seemed severe, and worth publicity. But then with things like this, I'm not sure. Is this a severe issue? Or is it just a run of the mill issue that's only newsworthy because web security is on people's minds right now?
The whole industry is on edge right now, and numbers wise the CVE count has exploded beyond belief. It's probably to take the side of caution, treat everything as important and update everything promptly rather than the old way of doing things where libraries are left months or years out of date until something happens.
> I's probably to take the side of caution, treat everything as important and update everything promptly
The risk is that if people keep seeing headlines about some vuln emergency that isn't in fact exploitable in most cases they'll just start to ignore them.
If your code ever accesses an HTTP URL that server can hack it. Some of the time, clients might be able to hack it too. This is comparable to the PHP issue.
I’d say this is reasonably severe. For a decently large class of servers exposed to the internet there’s a pretty simple way to RCE them. The actual set of vulnerable servers isn’t nearly as big as many would like to suggest. But if you’re running a node/express server, you should really be in panic mode right now.