Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade zstd | Mar 26, 2024 | Mar 4, 2021 |
| Debian | — | Upgrade libzstd | Mar 3, 2021 | Mar 3, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libzstdUpgrade libzstd-develUpgrade zstd | Sep 24, 2021 | Mar 4, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade zstd | Aug 10, 2021 | Mar 4, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 4, 2021 |
| Suse | — | Upgrade libzstd-devel-staticUpgrade libzstd-develUpgrade libzstd1-32bitUpgrade zstdUpgrade libzstd1 | Mar 29, 2021 | Mar 4, 2021 |
| Ubuntu | — | Upgrade libzstd1Upgrade libzstd1 (Ubuntu Pro)Upgrade zstdUpgrade zstd (Ubuntu Pro) | Mar 9, 2021 | Mar 4, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 4, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub