In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade zstd | Aug 22, 2024 | Mar 4, 2021 |
| Debian | — | Upgrade libzstd | Mar 3, 2021 | Mar 3, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libzstd-develUpgrade libzstdUpgrade zstd | Sep 24, 2021 | Mar 4, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade zstd | Aug 10, 2021 | Mar 4, 2021 |
| Suse | — | Upgrade libzstd-devel-staticUpgrade zstdUpgrade libzstd-develUpgrade libzstd1Upgrade libzstd1-32bit | Mar 29, 2021 | Mar 4, 2021 |
| Ubuntu | — | Upgrade zstd (Ubuntu Pro)Upgrade libzstd1 (Ubuntu Pro)Upgrade libzstd1Upgrade zstd | Mar 9, 2021 | Mar 4, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub