MEDIUM

GHSA-2jq9-6xx7-3h29

`temporary` makes use of uninitialized memory

Details

Uninitialized memory is used as a RNG seed in temporary. This has been resolved in the 0.6.4 release. The crate is not intended to be used outside of a testing environment. For a general purpose crate to create temporary directories, [`tempfile`](https://crates.io/crates/tempfile) is an alternative for this crate.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/temporary

Introduced in: 0.3.0Fixed in: 0.6.4

Upgrade temporary to 0.6.4 or newer (ecosystem crates.io).

References

https://github.com/stainless-steel/temporary/issues/2[WEB]
https://github.com/stainless-steel/temporary[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2018-0022.html[WEB]