Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade zstd | Mar 26, 2024 | Mar 4, 2021 |
| Debian | — | Upgrade libzstd | Mar 3, 2021 | Mar 3, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libzstdUpgrade libzstd-develUpgrade zstd | Sep 24, 2021 | Mar 4, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade zstd | Aug 10, 2021 | Mar 4, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 4, 2021 |
| Suse | — | Upgrade libzstd-develUpgrade libzstd1-32bitUpgrade libzstd-devel-staticUpgrade libzstd1Upgrade zstd | Mar 29, 2021 | Mar 4, 2021 |
| Ubuntu | — | Upgrade zstd (Ubuntu Pro)Upgrade libzstd1Upgrade zstdUpgrade libzstd1 (Ubuntu Pro) | Mar 9, 2021 | Mar 4, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 4, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub