{"id":"GHSA-2jq9-6xx7-3h29","aliases":["RUSTSEC-2018-0022"],"status":"published","title":"`temporary` makes use of uninitialized memory","description":"Uninitialized memory is used as a RNG seed in temporary. This has been resolved in the 0.6.4 release. The crate is not intended to be used outside of a testing environment. For a general purpose crate to create temporary directories, [`tempfile`](https://crates.io/crates/tempfile) is an alternative for this crate.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2018-08-22T12:00:00Z","modified":"2023-11-08T04:14:07Z","fixes":[{"ecosystem":"crates.io","package":"temporary","fixed_in":["0.6.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"temporary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"0.6.4"}]}]},{"source":"osv","ecosystem":"crates.io","package":"temporary","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"0.6.4"}]}]},{"source":"osv","ecosystem":"crates.io","package":"temporary","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"0.6.4"}]}]}],"references":[{"url":"https://github.com/stainless-steel/temporary/issues/2","tags":["web","report"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2018-0022.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-2jq9-6xx7-3h29"},{"url":"https://github.com/stainless-steel/temporary","tags":["package"]},{"url":"https://crates.io/crates/temporary","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-2jq9-6xx7-3h29","title":"`temporary` makes use of uninitialized memory","description":"Uninitialized memory is used as a RNG seed in temporary. This has been resolved in the 0.6.4 release. The crate is not intended to be used outside of a testing environment. For a general purpose crate to create temporary directories, [`tempfile`](https://crates.io/crates/tempfile) is an alternative for this crate.\n","status":"published","published":"2022-08-11T18:10:52Z","modified":"2023-06-13T22:08:06Z","updated_at":"2026-11-02T14:36:54.225318Z"}],"osv":[{"id":"GHSA-2jq9-6xx7-3h29","title":"`temporary` makes use of uninitialized memory","description":"Uninitialized memory is used as a RNG seed in temporary. This has been resolved in the 0.6.4 release. The crate is not intended to be used outside of a testing environment. For a general purpose crate to create temporary directories, [`tempfile`](https://crates.io/crates/tempfile) is an alternative for this crate.\n","status":"published","published":"2022-08-11T18:10:52Z","modified":"2023-11-08T04:14:07.505706Z","updated_at":"2026-11-02T15:46:34.338541Z"},{"id":"RUSTSEC-2018-0022","title":"Use of uninitialized memory in temporary","description":"Uninit memory is used as a RNG seed in temporary\n\nThe following function is used as a way to get entropy from the system, which does operations on and exposes uninit memory, which is UB.\n\n```rust\nfn random_seed(_: \u0026Path, _: \u0026str) -\u003e [u64; 2] {\n    use std::mem::uninitialized as rand;\n    unsafe { [rand::\u003cu64\u003e() ^ 0x12345678, rand::\u003cu64\u003e() ^ 0x87654321] }\n}\n```\n\nThis has been resolved in the 0.6.4 release.\n\nThe crate is not intended to be used outside of a testing environment.\n\nFor a general purpose crate to create temporary directories, [`tempfile`](https://crates.io/crates/tempfile) is an alternative for this crate.","status":"published","published":"2018-08-22T12:00:00Z","modified":"2023-11-08T04:14:07.505706Z","updated_at":"2026-11-02T15:53:39.492624Z"}]}}