GHSA-2jq9-6xx7-3h29: `temporary` makes use of uninitialized memory

August 11, 2022 (updated June 13, 2023)

Uninitialized memory is used as a RNG seed in temporary. This has been resolved in the 0.6.4 release. The crate is not intended to be used outside of a testing environment. For a general purpose crate to create temporary directories, tempfile is an alternative for this crate.

References

github.com/advisories/GHSA-2jq9-6xx7-3h29
github.com/stainless-steel/temporary
github.com/stainless-steel/temporary/issues/2
rustsec.org/advisories/RUSTSEC-2018-0022.html

Code Behaviors & Features

Detect and mitigate GHSA-2jq9-6xx7-3h29 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →