GHSA-2jq9-6xx7-3h29: `temporary` makes use of uninitialized memory

August 11, 2022 (updated June 13, 2023)

Uninitialized memory is used as a RNG seed in temporary. This has been resolved in the 0.6.4 release. The crate is not intended to be used outside of a testing environment. For a general purpose crate to create temporary directories, tempfile is an alternative for this crate.

References

github.com/advisories/GHSA-2jq9-6xx7-3h29
github.com/stainless-steel/temporary
github.com/stainless-steel/temporary/issues/2
rustsec.org/advisories/RUSTSEC-2018-0022.html

Code Behaviors & Features

Detect and mitigate GHSA-2jq9-6xx7-3h29 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →