RUSTSEC-2021-0115: 
Rust vulnerability analysis and mitigation

The vulnerability (RUSTSEC-2021-0115) affects the zeroize_derive crate before version 1.1.1 for Rust. The issue was discovered where dropped memory is not zeroed out for an enum when using the #[zeroize(drop)] attribute. This vulnerability was disclosed in December 2021 (CVE Database).

The vulnerability stems from a bug where the #[zeroize(drop)] attribute fails to generate a Drop implementation when used on enums in version 1.1 of zeroize_derive. This means that sensitive data in enum variants would not be properly zeroed out when dropped, potentially leaving sensitive information in memory. The issue was later fixed in version 1.2 through PR #847 (GitHub Issue).

When exploited, this vulnerability could lead to sensitive information remaining in memory after an enum instance is dropped, potentially exposing confidential data to unauthorized access. This is particularly concerning in security-focused applications that rely on the zeroize functionality to clear sensitive data from memory.

Users should upgrade to zeroize_derive version 1.1.1 or later, which contains the fix for this vulnerability. If upgrading is not immediately possible, a temporary workaround would be to implement manual memory zeroing in a custom Drop implementation for affected enums (CVE Database).