Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Party
Fastly
the most candid vendor on exploitability and on what a WAF cannot do
Claims this site attributes to this party
| Claim | Who says it | Status | Fact-check | Primary | Sources |
|---|---|---|---|---|---|
| Triggering the bug is much easier than turning it into code execution; the CVSS vector says attack complexity high Fastly: 'most deployments may be safe from RCE. Do not assume this holds true for you.' Imperva: five demonstrated techniques, three via session upload progress; about 67 KB of memory disclosed per attack. fact timeline → | Imperva; Fastly; the CVE record | confirmed | A3 Echoed●●●○○○ opinion status overstated | 3/3 | Imperva Threat Research Fastly CVE record |
| Patching the demonstrated paths does not make the bailout mechanism safe; more paths should be expected A position, from a vendor; consistent with the Fediverse report of a third bug. fact timeline → | Fastly | reported | A2 Reported●●○○○○ opinion | 1/2 | Fastly oss-security |