CVE-2021-45710 issue in actix-web's dependency - tokio

[wyhgoodjob]

Expected Behavior

Actix and its dependencies should have no known vulnerabilities unpatched

Current Behavior

Hi, from the CVE-2021-45710, there is a race which tokio version before 1.13.0 could be influenced, causing the tokio panic.

Possible Solution

In the tokio 4226 pull request, this race has been fixed, so update tokio to 1.15 or higher could fix this issue.

Steps to Reproduce

actix-web 4.0.0-beta.18
  │   ├── ...
  │   ├── actix-rt 2.5.0
  │   │   └── tokio 1.5.1 (the tokio version that have this security issue)

[robjtede]

The user side mitigation for reports like this is to run cargo update to bump the transitive Tokio dep.

[robjtede]

min version has been bumped in actix-rt 2.5.1