GHSA-8xw8-mmqv-frqq: fake-static allows converting any reference into a `'static` reference

August 25, 2021

fake-static allows converting a reference with any lifetime into a reference with 'static lifetime without the unsafe keyword.

Internally, this crate does not use unsafe code, it instead exploits a soundness bug in rustc

References

github.com/NieDzejkob/fake-static
github.com/advisories/GHSA-8xw8-mmqv-frqq
github.com/rust-lang/rust/issues/25860
rustsec.org/advisories/RUSTSEC-2020-0013.html

Detect and mitigate GHSA-8xw8-mmqv-frqq with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →