PT-2018-15605 · Actix Web · Actix-Web
Publicado
2018-06-08
·
Atualizado
2022-01-06
·
CVE-2018-25024
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
actix-web versions prior to 0.7.15
Description
The issue is related to multiple memory safety problems, including unsoundly coercing immutable references to mutable references, unsoundly extending lifetimes of strings, and adding the
Send marker trait to objects that cannot be safely sent between threads. This may result in various memory corruption scenarios, most likely use-after-free.Recommendations
For versions prior to 0.7.15, update to version 0.7.15 or later to resolve the memory safety issues.
As a temporary workaround, consider restricting the use of functions that may be affected by the memory corruption until a patch is available.
Avoid using the affected crate in multithreaded environments until the issue is resolved.
Correção
Race Condition
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Actix-Web