CRITICAL9.1

GHSA-hhw2-pqhf-vmx2

Use after free in actix-utils

Details

An issue was discovered in the actix-utils crate before 2.0.0 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/actix-utils

Introduced in: 0Fixed in: 2.0.0

Upgrade actix-utils to 2.0.0 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2020-35898[ADVISORY]
https://github.com/actix/actix-net/issues/160[WEB]
https://github.com/actix/actix-net/commit/0dca1a705ad1ff4885b3491ecb809a808e1de66c[WEB]
https://github.com/actix/actix-net[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2020-0045.html[WEB]