Uninit memory is used as a RNG seed in temporary

[pinkforest]

Hi @IvanUkhov

Could you please provide a comments around both the potential security impact and feasibility for us to give gentle nudge to the users who are still downloading this to switch to the newer version of this crate ?

rustsec/advisory-db#1196 (comment)

There isn't too many downloads but some people are still downloading the old versions:
https://crates.io/crates/temporary

It would be potentially a bit like an "informational" warning in tooling like cargo deny to switch over and could help keep things moving to the new version too.

As there are some concerns from community where we are evaluating whether we could flag informational advisory around the #1 that was raised earlier - however feedback / input from the maintainer would be essential as to how and if we should approach this.

It would be perhaps fruitful if you could use the cargo yank to yank the unsound versions off from crates.io as these are still being downloaded - thanks for your time.

Cheers

[IvanUkhov]

Sorry for the late response! It is a lot of traffic for the versions prior to the current one. I am not sure if yanking is a good strategy.