GHSA-gjrj-9rj4-pgwx: Perseus actix web Denial of Service Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-gjrj-9rj4-pgwx",
  "modified" : "2021-12-17T19:33:49Z",
  "published" : "2021-12-15T22:51:07Z",
  "aliases" : [ ],
  "summary" : "DoS Vulnerability from Upstream Actix Web Issues",
  "details" : "### Impact\nThis vulnerability affects all users of the `perseus deploy` functionality who have not exported their sites to static files. If you are using the inbuilt Perseus server in production, there is a memory leak in Actix Web stemming from [this upstream issue](https://github.com/actix/actix-web/issues/1780) which can allow even a single user to cause the process to exhaust its memory on low-memory servers by continuously reloading the page. Note that this issue does not affect all Actix Web applications, but rather results from certain usage patterns which appear to be present in Perseus' server mechanics.\n\n### Patches\nThis vulnerability is addressed in all versions after Perseus `v0.3.0-beta.21`, which temporarily discontinues the use of `perseus-actix-web` (until the upstream bug is fixed) and switches to `perseus-warp` instead, which utilizes [Warp](https://github.com/seanmonstar/warp).\n\nAdditionally, as of Perseus `v0.3.0-beta.22`, the Actix Web integration has been upgraded to use the latest unstable beta version of Actix Web, which appears to partially resolve this issue (the severity of the memory leak is reduced). However, due to the instability of this version, the default integration will remain Warp for now, and a warning will appear if you attempt to use the Actix Web integration.\n\n<details>\n<summary>Using the Actix Web integration</summary>\n\nIf the instability of the latest beta version of Actix Web is not a concern for you, you can use this integration by adding `-i actix-web` to `perseus serve` and the like. This will print a warning about instability, and will then operate with the beta version. Please report any failures in functionality that are not security-related to the Perseus team by [opening an issue on the repository](https://github.com/arctic-hen7/perseus/issues/new/choose).\n\nNote however that switching to the Warp integration requires no code changes whatsoever unless you've ejected, so there are very few disadvantages to this change.\n\n</details>\n\n### Workarounds\nDue to significant infrastructural changes within other Perseus packages that were needed to support Warp, this integration is not backward-compatible with any previous version of Perseus, meaning there are no easily feasible workarounds. If you're only in development though, this vulnerability is irrelevant until you push to production.\n\n### CVE Status\n\nDue to GitHub's requirements, a CVE can't be issued for this security advisory because the issue is technically one with Actix Web (though it's only in combination with certain mechanics in the Perseus server that this problem arises).\n\n### References\nSee [this upstream issue](https://github.com/actix/actix-web/issues/1780) in Actix Web.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue on this repository\n* Email me at [arctic_hen7@pm.me](mailto:arctic_hen7@pm.me)\n",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "perseus-actix-web"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.3.0-beta.22"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.3.0-beta.21"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/arctic-hen7/perseus/security/advisories/GHSA-gjrj-9rj4-pgwx"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/actix/actix-web/issues/1780"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/arctic-hen7/perseus"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2021-12-15T21:42:48Z",
    "nvd_published_at" : null
  }
}