GHSA-2jq9-6xx7-3h29

    Dashboard / Vulnerabilities / GHSA-2jq9-6xx7-3h29

    GHSA-2jq9-6xx7-3h29

    Published: 11 Aug 2022Last Modified: 8 Nov 2023

    Summary: `temporary` makes use of uninitialized memory

    Details: Uninitialized memory is used as a RNG seed in temporary. This has been resolved in the 0.6.4 release. The crate is not intended to be used outside of a testing environment. For a general purpose crate to create temporary directories, [`tempfile`](https://crates.io/crates/tempfile) is an alternative for this crate.

    References: https://github.com/stainless-steel/temporary/issues/2, https://github.com/stainless-steel/temporary, https://rustsec.org/advisories/RUSTSEC-2018-0022.html

    Affected packages

    Package

    Name: temporary

    Purl: pkg:cargo/temporary

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.3.0
    Fixed -0.6.4

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High