MEDIUM5.5

GHSA-whc7-5p35-4ww2

Use after free in actix-service

Details

An issue was discovered in the actix-service crate before 1.0.6 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/actix-service

Introduced in: 0Fixed in: 1.0.6

Upgrade actix-service to 1.0.6 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2020-35899[ADVISORY]
https://github.com/actix/actix-net/pull/158[WEB]
https://github.com/actix/actix-net/commit/a67e38b4a07c92a3c81fa833f9eb1e91e74e39b7[WEB]
https://github.com/actix/actix-net[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2020-0046.html[WEB]