CVE-2020-35901

CVE-2020-35901 affects the actix-http crate for Rust, with exploitation possible via a use-after-free in BodyStream caused by lack of pinning. The issue is tied to the crate’s handling of buffers and memory location, and is mitigated by upgrading to a fixed version (2.0.0-alpha.1) or later as ind...

CVE-2020-35901

An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. There is a use-after-free in BodyStream...

CVE-2020-35902

CVE-2020-35902 affects the actix-codec crate prior to 0.3.0-beta.1 for Rust, with a use-after-free in Framed caused by lack of proper pinning. The issue is documented in RUSTSEC-2020-0049 and various feeds (Red Hat, OSV, GHSA). Impact is reflected in CVSS metrics (up to Critical in v3.1, HIGH in ...

CVE-2020-35902

An issue was discovered in the actix-codec crate before 0.3.0-beta.1 for Rust. There is a use-after-free in Framed...

Rust Resource Management Error Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust actix-utils crate before 2.0.0, which stems from a Cell implementation that allows obtaining multiple mutable references to the same data...

Rust Resource Management Error Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in actix-service crate before 1.0.6 for Rust, where the Cell implementation allows obtaining multiple mutable references to the same data...

Rust Resource Management Error Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A resource management error vulnerability exists in Rust actix-codec crate before 0.3.0-beta.1, which stems from having a use-after-free framework...

Rust Resource Management Error Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust actix-http crate before 2.0.0-alpha.1, which stems from BodyStream having a use-after-free...

CLI-game-of-life (=0.1.0), RustyBox (=0.1.0) +1539 more potentially affected by CVE-2020-35922 via mio (=0.7.14)

mio CARGO version =0.7.14 is affected by a known vulnerability. The following packages have a transitive dependency on mio and may be impacted: - CLI-game-of-life =0.1.0 - RustyBox =0.1.0 - RustyVault =0.1.0, =0.1.0, =2.0.0-beta.1, =0.1.0, =0.9.0, =0.9.0, =0.1.0, =0.1.0, =0.1.0, =0.4.0 and more...

NeteaseCloudMusicRustApi (=0.1.1), RustMusic (=0.1.0) +325 more potentially affected by CVE-2020-35902 via actix-codec (>=0.1.2 <=0.2.0)

actix-codec CARGO version =0.1.2, =0.1.0, =0.8.0, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.1 - actix-delay =0.1.0 - actix-diesel-actor =0.1.1 and more Source cves: CVE-2020-35902 Source advisory: OSV:RUSTSEC-2020-0049...

NeteaseCloudMusicRustApi (=0.1.1), RustMusic (=0.1.0) +313 more potentially affected by CVE-2020-35901 via actix-http (>=0.1.5 <=1.0.1)

actix-http CARGO version =0.1.5, =0.1.0, =0.8.0, =0.1.8, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0 and more Source cves: CVE-2020-35901 Source advisory: OSV:RUSTSEC-2020-0048...

NeteaseCloudMusicRustApi (=0.1.1), RustMusic (=0.1.0) +319 more potentially affected by CVE-2020-35898 via actix-utils (>=0.3.5 <=1.0.6)

actix-utils CARGO version =0.3.5, =0.1.0, =0.8.0, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1 and more Source cves: CVE-2020-35898 Source advisory: OSV:RUSTSEC-2020-0045...

NeteaseCloudMusicRustApi (=0.1.1), RustMusic (=0.1.0) +171 more potentially affected by CVE-2020-35899 via actix-service (>=0.1.6 <=0.4.2)

actix-service CARGO version =0.1.6, =0.8.0, =0.1.8, =0.1.0, =0.1.0, =0.1.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1 and more Source cves: CVE-2020-35899 Source advisory: OSV:RUSTSEC-2020-0046...

actix (>=0.5.0 <=0.7.7), actix-ogn (=0.1.0) +270 more potentially affected by CVE-2019-15553 via memoffset (>=0.1.0 <=0.2.1)

memoffset CARGO version =0.1.0, =0.5.0, =0.7.5, =0.2.5, =0.4.0, =0.9.0, =0.1.0, =0.1.0, =0.4.0, =0.5.0, =0.4.0, =0.7.0 and more Source cves: CVE-2019-15553 Source advisory: OSV:RUSTSEC-2019-0011...

actix-async-await (>=0.3.0 <=0.3.0-alpha.1), actix-broker (>=0.1.3 <=0.1.7) +91 more potentially affected by CVE-2018-25024 +2 more via actix-web (>=0.2.1 <=0.7.19)

actix-web CARGO version =0.2.1, =0.3.0, =0.1.3, =0.1.0, =0.3.0, =0.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.4.0, =0.4.3 and more Source cves: CVE-2018-25024, CVE-2018-25025, CVE-2018-25026 Source advisory: OSV:RUSTSEC-2018-0019...