CVE-2018-25025
published 2021-12-27CVE-2018-25025: An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory corruption.
PriorityP345critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.33%
70.9th percentile
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory corruption.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| actix | actix-web | < 0.7.15 | 0.7.15 |
| actix | actix-web | >= 0 < 0.7.15 | 0.7.15 |
| actix | actix-web | >= 0.0.0-0 < 0.7.15 | 0.7.15 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Out-of-bounds Write in actix-web
ghsa·2022-01-06
CVE-2018-25025 [CRITICAL] CWE-787 Out-of-bounds Write in actix-web
Out-of-bounds Write in actix-web
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory corruption.
OSV
Out-of-bounds Write in actix-web
osv·2022-01-06
CVE-2018-25024 [CRITICAL] Out-of-bounds Write in actix-web
Out-of-bounds Write in actix-web
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory corruption.
OSV
Out-of-bounds Write in actix-web
osv·2022-01-06
CVE-2018-25024 [CRITICAL] Out-of-bounds Write in actix-web
Out-of-bounds Write in actix-web
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly coerce an immutable reference into a mutable reference, leading to memory corruption.
OSV
Out-of-bounds Write in actix-web
osv·2022-01-06
CVE-2018-25024 [CRITICAL] Out-of-bounds Write in actix-web
Out-of-bounds Write in actix-web
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption.
OSV
CVE-2018-25025: An issue was discovered in the actix-web crate before 0
osv·2021-12-27·CVSS 9.8
CVE-2018-25025 [CRITICAL] CVE-2018-25025: An issue was discovered in the actix-web crate before 0
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory corruption.
OSV
Multiple memory safety issues in actix-web
osv·2021-08-25
CVE-2018-25024 [MEDIUM] Multiple memory safety issues in actix-web
Multiple memory safety issues in actix-web
Affected versions contain multiple memory safety issues, such as:
- Unsoundly coercing immutable references to mutable references
- Unsoundly extending lifetimes of strings
- Adding the `Send` marker trait to objects that cannot be safely sent between threads
This may result in a variety of memory corruption scenarios, most likely use-after-free.
A signficant refactoring effort has been conducted to resolve these issues.
OSV
Multiple memory safety issues
osv·2018-06-08
CVE-2018-25024 Multiple memory safety issues
Multiple memory safety issues
Affected versions contain multiple memory safety issues, such as:
- Unsoundly coercing immutable references to mutable references
- Unsoundly extending lifetimes of strings
- Adding the `Send` marker trait to objects that cannot be safely sent between threads
This may result in a variety of memory corruption scenarios, most likely use-after-free.
A significant refactoring effort has been conducted to resolve these issues.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-12-27
Published