admin 近日，谷歌研究人员披露了云服务商cloudflare的Cloudbleed HTTPS流量泄漏漏洞，目前多家著名网站用户的一些会话令牌、密码、私人消息、API密钥和其他一些敏感数据被cloudflare随机泄露给了访问者，甚至被搜索引擎缓存或已被黑客收集。该漏洞与心脏出血(Heartbleed)的原理类似，因此被称为“Cloudbleed”云出血。
根据调查显示，使用Cloudflare代理的站点，一旦启用了HTML重写功能，就会导致正在存储中的的任何数据被扰乱。每一个使用Cloudflare代理服务的站点都将受到波及，即使是使用HTTPS保护的站点也未能幸免。
最受影响的时间是2月13日到2月18日,使用Cloudflare的站点有千万分之三的内存泄露概率。
目前已确认受影响的领域如下：
如何正确应对？
正确的应对策略是，要求供应商和网站重置所有会话令牌，因为更多的响应数据泄漏和请求数据通常包含会话令牌而不是密码。如果您使用的网站有“日志退出所有活动会话”功能，可以进行操作。如果您使用的网站没有注销所有活动会话的功能，请与供应商联系并要求他们重置他们所有的会话令牌。
为了更加的安全，您应该对密码管理器进行检查并更改所有密码，尤其是那些受影响网站上的密码，并对你的重要帐户设置双因子验证，这可能听起来有点耸人听闻，但这种泄漏的范围是巨大的。
理论上来讲，不在此列表中的网站也可能受到影响（因为受影响的网站可能向未受影响的网站发出了API请求），您应该尽可能的更改所有重要密码。
数据源：
受影响网站列表如下：
au
coinba
bi
be
transferwi
bi
news.ycombina
medium.com
4c
yelp.com
okcu
zende(Zendesk post and updates | no leaked data found)
uber.com
localbi
kraken.com
23andme.com
cur(and some other Curse sites likeminecra)
coun
myaccount.ny
cloud
blockc
di(affected)
digi(no leaked data found in several search engine caches)
namec(no leaked data found in several search engine caches)
gla(no leaked data found in several search engine caches)
vul(no leaked data found in several search engine caches)
(not affected,#2)
1(not affected)
Alexa Top 10,000 on Cloudflare DNS:
u
code
ex
ge
jquery.com
laravel.com
laraca
bi
zi
gla
di
c
(affected)
irccloud.com
000web
1001
101grea
10minu
123
1
1jux.net
1news.az
1
1
24
24
2c
2ch.hk
2ch.net
2ip.ru
3bme
4c
4d
4
4
5giay.vn
800no
96down.com
abidjan.net
ab
ada
add-anime.net
addic
addic
addme
add
adf.ly
ad
ad
adul
adv
adx
a
a
a
agilebi
a
a
a
ai
ak
ak
al-ak
aleqt.com
alexaboo
al
al
al
ali
ali
aljaras.com
allanal
all.biz
allk
allmyvideos.net
all
almaany.com
alma
alme
alna
al
alrakoba.net
al
al
alwa
alwa
alweeam.com.sa
amader
amarujala.com
amino.dk
anandabazar.com
androidau
androidcen
android
angloin
anime44.com
anime
animeid.tv
animenew
ani
ani
ann.az
annunci69.it
an
an
an
any.gs
a
a
a
a
a
a
a
arab
arc
argen
arioo.com
ari
armorgames.com
arouraios.gr
ar
ashleymadi
ashleyrnadi
a
a
a
au
avaaz.org
avaz.ba
avazu
avi
avi(confirmed by @toogle from Avi as not affected)
avn.in
azer
aznews.az
azyya.com
b1.org
bab.la
babyoye.com
backlinks.com
baku
bancdebinary.com
banglanew
barstoolspor
bb
bc.vc
bdr130.net
beeg.com
be
belboon.com
be
bezaat.com
bica
bigrock.in
bikroy.com
billiger.de
billionu
binaryo
bin
bitcoinchar
bi
bi
biz
black
black
blankre
blee
blekko.com
blinkli
blip.tv
blockc
blogca
blog
blogs.com
boards.ie
boo-box.com
boxden.com
boxing
brain
brainyquo
brandyour
bra
briian.com
broadwayworld.com
bron
brooonzyah.net
bru
b
bubblews.com
bu
bukkit.org
burbuja.info
burnews.com
bu
bu
buzz
cam
cancan.ro
career
car.gr
ca
cbox.ws
cda.pl
ce4arab.com
celebuzz.com
c
c
c
c
c
c
cima4u.com
ciudad.com.ar
ck101.com
cla
cla
clean
clickbank.com
clickbank.net
clip.vn
clixsen
cloud
clubedo
cm
code
code
coinba
col3negoriginal.lk
colourlovers.com
comicbookmovie.com
com
co
c
c
c
crackberry.com
crea
cric
cric
crocko.com
cro
crunchba
crunc
c
c
cucirca.eu
cur
cyanogenmod.org
cyberchim
cyber
dailycaller.com
dai
dangerou
dardarkom.com
da
davidicke.com
davidwal
dawanda.com
dawn.com
de10.com.mx
deadline.com
de
de
de
demand
demo
de
de
de
de
de
de
de
desitorren
de
de
deu
dev-
dhakatime
diariocontras
diariodemorelos.com
diario.mx
diary.ru
dicelacancion.com
di
digikala.com
digi
digital-photography-
digital
di
divx
divx
dizi-mag.com
djmaza.info
dlink.com
dl-
dnevnik.hr
doba.com
doi
doityour
doo
do
do
downloada
downloadming.me
downloads.nl
d
drakula
drama
dreamama
dreamincode.net
dream
dreamtempla
droid-li
drudgere
dryicons.com
d
duedil.com
dum
dx.com
ea
ebs.in
e-cigare
econ
edublogs.org
e-e
e
egali
egyup.com
el-a
elance.com
el-balad.com
elbilad.net
elbo
eldia.com.ar
ele
ele
el
el
eli
eli
elk
el
el
elwa
el-wlid.com
emailme
emoney
e-monsi
encuen
engli
enjoydre
enwdg
e
ere
ero-adver
e
e
excellen
expatria
ex(no leaked data found in several search engine caches)
ex
ex
ex
ex
ex
ex
eyny.com
ezilon.com
ez
fakenamegenera
fan
font
free-press-relea
frm
fuska
gaaks.com
game321.com
gameblog.fr
game-deba
game
gamer.com.tw
games.la
gamestorren
game
gamevicio.com
gamme.com.tw
geen
gen
geo.tv
ge
ge
ge
ge
gezginler.net
gezin
g
g
g
g
gigaom.com
gig
gi
gla
globalewallet.com
globovi
gmane.org
godvine.com
go
gogoanime.com
goldenline.pl
golde
goldporn
gold
gooddrama.net
good.is
good
go
go
graaam.com
gra
greenwichmean
grind
g
g
g
gulli.com
gun.az
gyazo.com
hardsex
hawk
hostga.br
huge
ice
iconarc
iden
idlebrain.com
ii
ijreview.com
ikman.lk
ilbe.com
ilyke.net
imagecurl.org
image
imagetwi
imgc
imgc
imgdino.com
img
img
imore.com
im
inbound.org
index.hr
index-o
india-
india
indiangilma.com
indian
indian
indoweb
inews.gr
in
in
in
in
inkedmag.com
inlinkz.com
inquirer.net
in
instantcheckma
in
in
in
in
iof
iol.co.za
i
i
i
iptorren
i
i
i
i
ixl.com
jagobd.com
jang.com.pk
java
jeanmarcmorandini.com
j.gs
jne.co.id
joemon
jo
jonloomer.com
joomla.fr
joomlart.com
joom
jot
jquery.com
jquerymobile.com
jqueryui.com
ju
ju
ju
jvzoo.com
kaban.tv
kala
kanui.com.br
karnaval.com
ka
kee
k
k
kingworldnews.com
kinogo.net
kinox.to
kinozal.tv
kleiderkrei
klick
klix.ba
kn3.net
komikid.com
korabia.com
kora-online.tv
korben.info
krucil.net
k
kure.tv
kwejk.pl
lankacnews.com
la
laravel.com
largeporn
la
laug
layalina.com
lebu
legiaodo
len
levelup.com
lewrockwell.com
liber
li.tw
lig
liilas.com
lik.cl
like4like.org
like
likes.com
limetorren
linkbucks.com
linkcollider.com
linkconnec
linkcry
link
li
listver
livememe.com
lolinez.com
lolnexus.com
loo
lum
m5zn.com
ma
makeameme.org
makeu
makezine.com
malay
malwareti
managewp.com
manga
manga
manga
mangareader.net
manga
mano
ma
mara
marke
marunadanmalayali.com
ma
ma
ma
maul
maxicep.com
maxmind.com
mazika2day.com
media(not proxified by CF and not affected)
media
media
medium.com
mega
members.webs.com
memecen
memedad.com
meme-lol.com
men
merca20.com
m
mg.co.za
micromaxin
microworkers.com
mindmei
mind
minecra
minijuegos.com
minu
mi
mixcloud.com
mixedmartialar
mkyong.com
mmo-c
moba
mobili
moddb.com
moneymakergroup.com
monova.org
moodle.org
morgue
moveon.org
movie4k.to
movie-blog.org
movieweb.com
m
m
m
mu
mybb.com
mybroadband.co.za
mydealz.de
mydigi
myegy.com
mygully.com
mylikes.com
mymodernmet.com
mynewsde
myorderbox.com
my
my
myvid
n4g.com
n4
naija
naij.com
nairaland.com
name
nao
na
na
ncry
ne
ne
network-
newgrounds.com
news.am
new
nexu
nguoidua
nicozon.net
ninisi
niu
nmi
nodejs.org
no
no
no
no
nova
nowgamez.com
nrc.nl
nuevoloquo.com
nulled.cc
nullre
nur.kz
nyaa.se
ocio
ode
o
o
ojooo.com
omegle.com
on.cc
onedio.com
onlinek
online
online-
oodle.com
o
o
o
o
o
o
o
orga
o
pccomponen
persian
pimpand
pix
plugru
porn
privatehomecli
prompt
psychcen
pubdirec
purple
q8yat.com
qa
q-a
qa
qaynar.info
q.gs
que
r10.net
racing-games.com
radiojavan.com
ra
random.org
ranker.com
ra
ra
ra
raven
raw
reac
readms.com
real
reali
redbubble.com
re-direcciona.me
reduxmediia.com
relink.us
re
re
rg
ripoffre
rob
rock
roro44.com
ro
rozee.pk
rubia
rune
rune
runner
rus.ec
ryu
searchquo
servi
sharea
sip
site
siyahgaze
slaa
slimspo
smallseo
smartinsigh
smo
solidtrus
ssen
stadela
stansberryre
stargaze
statcoun
stocktwi
stuffga
sub
(not proxied by CF and not affected)
templatemon
thedailybea
theme-fu
thingiver
thisoldhou
trade
trafficestima
trueactivi
uber.com
udemy.com
uludag
uni
u
u
u
usingengli
u
u
uwan
vanguardngr.com
vavel.com
vcommis
vecernji.hr
vec
vetoga
vid2c.com
videarn.com
video.az
videomega.tv
video
videoyoum7.com
vid
viralnova.com
vivas.fi
vlad
vodly.to
vodonet.net
voe
voz
vr-zone.com
w3re
w4.com
warez-bb.org
warrior
wa
washington
wa
wa
wa
wa
wa
wa
waveap
wayn.com
weare
webcon
webde
webde
webgains.com
web
webhosting
webma
web-o
webre
webs.com
wed168.com.tw
we
weknowmemes.com
welove
w
w
w
w
w
w
w
wikiwiki.jp
wiziq.com
wiziwig.tv
wjunc
wmmail.ru
women
world
world
wor
wpcen
w
w
w
w
x-art.com
xat.com
xbmc.org
xen
xxxbunker.com
xxxkinky.com
yam.com
yaze
ye
ye
ye
yola.com
yoo7.com
yougetpaid
youge
youm7.com
yourbi
you
you
yuca
yuku.com
z6.com
zakon.kz
zalukaj.tv
zamalek
zaman.com.tr
zeman
zem
zen
zero10.net
ze
zi
zone-
zoomin
zoomit.ir
zurb.com
zwaar.net