GHSA-2jq9-6xx7-3h29
`temporary` makes use of uninitialized memory
GHSA-2jq9-6xx7-3h29 is a vulnerability with no CVSS score yet in temporary, published August 22, 2018. No source lists public exploit code. Fixed in temporary 0.6.4.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.6.4temporary
Description
Uninitialized memory is used as a RNG seed in temporary. This has been resolved in the 0.6.4 release. The crate is not intended to be used outside of a testing environment. For a general purpose crate to create temporary directories, tempfile is an alternative for this crate.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
temporarycrates.io | 0.3.0 up to 0.6.4 | 0.6.4 |
What each source reports
GitHub AdvisoriesNo score
`temporary` makes use of uninitialized memory
Uninitialized memory is used as a RNG seed in temporary. This has been resolved in the 0.6.4 release. The crate is not intended to be used outside of a testing environment. For a general purpose crate to create temporary directories, tempfile is an alternative for this crate.
- Record
GHSA-2jq9-6xx7-3h29- Updated
- 2026-11-02
OSVNo score
`temporary` makes use of uninitialized memory
Uninitialized memory is used as a RNG seed in temporary. This has been resolved in the 0.6.4 release. The crate is not intended to be used outside of a testing environment. For a general purpose crate to create temporary directories, tempfile is an alternative for this crate.
- Record
GHSA-2jq9-6xx7-3h29- Updated
- 2026-11-02
OSVRUSTSEC-2018-0022No score
Use of uninitialized memory in temporary
Uninit memory is used as a RNG seed in temporary
The following function is used as a way to get entropy from the system, which does operations on and exposes uninit memory, which is UB.
fn random_seed(_: &Path, _: &str) -> [u64; 2] {
use std::mem::uninitialized as rand;
unsafe { [rand::<u64>() ^ 0x12345678, rand::<u64>() ^ 0x87654321] }
}
This has been resolved in the 0.6.4 release.
The crate is not intended to be used outside of a testing environment.
For a general purpose crate to create temporary directories, tempfile is an alternative for this crate.
- Record
RUSTSEC-2018-0022- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.