Matthias Wessendorf the vulnerability exists on CBC padding and it doesn't affect the Push server once we don't CBC mode present. That's the reason why I didn't update our libraries before, either way I'm ok on updating, but is not critical or need to be classified as "Major"