RUSTSEC-2021-0089: Optional Deserialize implementations lacking validation

[github-actions]

Optional Deserialize implementations lacking validation

Details
Package	raw-cpuid
Version	7.0.4
URL	gz/rust-cpuid#43
Date	2021-01-20
Unaffected versions	<=3.1.0

When activating the non-default feature serialize, most structs implement
serde::Deserialize without sufficient validation. This allows breaking
invariants in safe code, leading to:

• Undefined behavior in as_string() methods (which use
  std::str::from_utf8_unchecked() internally).
• Panics due to failed assertions.

See gz/rust-cpuid#43.

A fix is not yet available, but most use cases do not require enabling
the serialize feature.

See advisory page for additional details.