In Project Zero #1139, it was disclosed that CloudFlare had a bug which disclosed uninitialized memory, leaking private data sent through them via SSL. What's the real impact?
Compared to the famous HeartBleed bug leak, this is similar in some ways: the uninitialized memory exposure means unrelated private data is disclosed.
The things that are better
This only affected code running on CloudFlare, and the bug ceased to function an hour after notification. No new data can be leaked via this bug.
If somebody had awareness of this bug, they couldn't target an individual with it. The dumped sessions appear to be random.
CloudFlare has logs, and they have disclosed no indication that anybody knew of and exploited this bug.
The things that are worse
The size of the uninitialized memory dumps is huge. They regularly capture full HTTP headers and substantial sections of the request body. This pretty much gives away all the data required to hijack a session, and if a login session was captured, it would of course include the password.
It was free-session-roulette. Repeated requests to invalid URLs would just dump more and more random data.
If somebody were aware of this, they could have crafted a page that caused it to create nearly arbitrary size data dumps, or even just repeatedly hit an already existing invalid URL.
An end user could be compromised without any weakness in the part of the website or the user.
A few unlucky users will still have that leaked data existing in caches after this disclosure, and they're going to be very widely disclosed. If those session cookies aren't invalidated, it's practically guaranteed somebody will log into their accounts.
How can somebody address an incident like this?
Limiting session token lifetimes and making use of proper two-factor authentication would address the long-term leaking of data, preventing somebody from acquiring a long-lived session. Customers of CloudFlare could invalidate all session cookies and force rotation of all passwords, though that's unlikely to happen.
What does this mean to me?
CloudFlare claims that no private SSL keys were leaked as they did termination within separate processes, so while the class of bug would normally raise concern there, it doesn't in this particular case.
It's a great lesson in the security community of thinking about possible long-term bugs that have a massive blast radius. Most people are likely completely unaffected, though as noted above a few people will have lost the Bad Luck Lottery.