CVE-2021-24032

EUVD-2021-10952
Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.7 MEDIUM
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 4%
Affected Products (NVD)
VendorProductVersion
facebookzstandard
1.4.1 ≤
𝑥
< 1.4.9
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libzstd
bookworm
1.5.4+dfsg2-5
fixed
bullseye
1.4.8+dfsg-2.1
fixed
sid
1.5.6+dfsg-1
fixed
stretch
not-affected
trixie
1.5.6+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libzstd
bionic
Fixed 1.3.3+dfsg-2ubuntu1.2
released
focal
Fixed 1.4.4+dfsg-3ubuntu0.1
released
groovy
Fixed 1.4.5+dfsg-4ubuntu0.1
released
hirsute
Fixed 1.4.8+dfsg-2build1
released
impish
Fixed 1.4.8+dfsg-2build1
released
jammy
Fixed 1.4.8+dfsg-2build1
released
kinetic
Fixed 1.4.8+dfsg-2build1
released
lunar
Fixed 1.4.8+dfsg-2build1
released
mantic
Fixed 1.4.8+dfsg-2build1
released
noble
Fixed 1.4.8+dfsg-2build1
released
trusty
dne
xenial
Fixed 1.3.1+dfsg-1~ubuntu0.16.04.1+esm3
released
Common Weakness Enumeration
References
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982519
https://github.com/facebook/zstd/issues/2491
https://www.facebook.com/security/advisories/cve-2021-24032
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982519
https://github.com/facebook/zstd/issues/2491
https://www.facebook.com/security/advisories/cve-2021-24032