Critical vulnerability found in widely used open-source web framework
Maintainers shipped a patch within eleven hours. The exposure window for unpatched deployments is considerably longer.
By Staff Writer4 min read
Section C
1 story
Cybersecurity
Vulnerabilities, patches, and the gap between a fix existing and a fix being deployed.
Opening of Critical vulnerability found in widely used open-source web framework
The technical severity is high and the fix is straightforward, which makes this a deployment problem rather than an engineering one.
Patch availability is not patch adoption. The median time-to-update for self-hosted deployments of comparable frameworks has historically run to several weeks, and a meaningful tail never updates at all. Organisations running managed platforms will have been patched automatically; organisations running their own infrastructure should treat this as same-day work.
Continue reading, 4 min : Critical vulnerability found in widely used open-source web framework
Elsewhere in the paper
End of Section CCybersecurity
Back to the front page