CVE-2020-8927 in brotli-sys dependency

[Shnatsel]

Expected Behavior

Actix and its dependencies should have no known vulnerabilities unpatched

Current Behavior

Actix is affected by CVE-2020-8927, buffer overflow in the Brotli C library, through brotli-sys crate.

Possible Solution

There is no updated release of brotli-sys that fixes the issue (it has been reported upstream). There are several abandoned PRs updating to newer Brotli, so it looks like a new release will not be cut anytime soon.

The brotli crate provides a pure Rust implementation of Brotli compression and decompression. It is used in production by Dropbox and is not affected by the issue (and could not be affected because it's written in safe Rust). I suggest switching to the brotli crate as a mitigation.

Steps to Reproduce (for bugs)

1. cargo install cargo-audit
2. cd actix-web
3. cargo audit

The dependency tree leading to the affected brotli-sys crate is:

brotli-sys 0.3.2
└── brotli2 0.3.2
    ├── awc 3.0.0-beta.14
    │   ├── actix-web-actors 4.0.0-beta.8
    │   ├── actix-web 4.0.0-beta.15
    │   │   ├── awc 3.0.0-beta.14
    │   │   ├── actix-web-codegen 0.5.0-beta.6
    │   │   │   └── actix-web 4.0.0-beta.15
    │   │   ├── actix-web-actors 4.0.0-beta.8
    │   │   ├── actix-test 0.1.0-beta.9
    │   │   │   ├── awc 3.0.0-beta.14
    │   │   │   ├── actix-web-codegen 0.5.0-beta.6
    │   │   │   ├── actix-web-actors 4.0.0-beta.8
    │   │   │   ├── actix-web 4.0.0-beta.15
    │   │   │   └── actix-files 0.6.0-beta.10
    │   │   ├── actix-multipart 0.4.0-beta.10
    │   │   ├── actix-http-test 3.0.0-beta.9
    │   │   │   ├── awc 3.0.0-beta.14
    │   │   │   ├── actix-test 0.1.0-beta.9
    │   │   │   └── actix-http 3.0.0-beta.16
    │   │   │       ├── awc 3.0.0-beta.14
    │   │   │       ├── actix-web-actors 4.0.0-beta.8
    │   │   │       ├── actix-web 4.0.0-beta.15
    │   │   │       ├── actix-test 0.1.0-beta.9
    │   │   │       ├── actix-multipart 0.4.0-beta.10
    │   │   │       ├── actix-http-test 3.0.0-beta.9
    │   │   │       └── actix-files 0.6.0-beta.10
    │   │   ├── actix-http 3.0.0-beta.16
    │   │   └── actix-files 0.6.0-beta.10
    │   ├── actix-test 0.1.0-beta.9
    │   └── actix-http-test 3.0.0-beta.9
    ├── actix-web 4.0.0-beta.15
    └── actix-http 3.0.0-beta.16

• Rust Version (I.e, output of rustc -V):
• Actix Web Version: actix-http 2.2.1, latest git.