PT-2019-16426 · Rust · Http Crate

CVE-2019-25009 · Publicado 2019-11-16 · Atualizado 2025-09-29

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions http crate versions prior to 0.1.20

Description An issue was discovered in the http crate for Rust, where the HeaderMap::Drain API can use a raw pointer, defeating soundness. This introduced unsoundness in its public safe API, potentially causing double-free issues if the Drain struct is not properly dropped, and violating Rust's alias rule, which can lead to data races with Drain's Iterator implementation.

Recommendations For versions prior to 0.1.20, update to version 0.1.20 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the HeaderMap::Drain API until the update is applied.

Correção

Double Free

Enumeração de Fraquezas

CWE-415

Identificadores relacionados

CVE-2019-25009

GHSA-6RHX-HQXM-8P36

RUSTSEC-2019-0034

Produtos afetados

Http Crate

Referências · 13

• https://osv.dev/vulnerability/GHSA-6rhx-hqxm-8p36 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-25009 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2019-25009 · Aviso do Fabricante
• https://osv.dev/vulnerability/RUSTSEC-2019-0034 · Aviso do Fabricante
• https://t.me/cvenotify/8002 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-25009 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-25009 · Nota de Segurança
• https://t.me/cvenotify/8219 · Publicação no Telegram
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-25009 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-25009 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-25009 · Aviso do Fabricante
• https://crates.io/crates/http · Nota
• https://rustsec.org/advisories/RUSTSEC-2019-0034.html · Nota