Add advisory for temporary

Author: 5225225

crates/temporary/RUSTSEC-0000-0000.md

@@ -0,0 +1,36 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "temporary"
+date = "2022-02-16"
+categories = ["memory-exposure"]
+keywords = ["uninitialized-memory"]
+
+[versions]
+patched = []
+unaffected = ["< 0.3.0"]
+```
+
+# Use of uninitialized memory as a RNG seed in temporary
+
+The following function is used as a way to get entropy from the system, which does operations on and exposes uninit memory, which is UB.
+
+```rust
+fn random_seed(_: &Path, _: &str) -> [u64; 2] {
+    use std::mem::uninitialized as rand;
+    unsafe { [rand::<u64>() ^ 0x12345678, rand::<u64>() ^ 0x87654321] }
+}
+```
+
+In addition, in release mode, the file names returned are completely predictable, as this test shows, which must be run in release.
+
+```rust
+fn main() {
+    assert_eq!(
+        temporary::Directory::new("foo").unwrap().into_path(),
+        std::path::Path::new("/tmp/foo.aaaaaaaaaaaa")
+    );
+}
+```
+
+[tempfile](https://crates.io/crates/tempfile) is the suggested replacement crate.