CVE-2021-24032

Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.7 MEDIUM
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
facebookCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 3%
VendorProductVersion
facebookzstandard
1.4.1 ≤
𝑥
< 1.4.9
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libzstd
bullseye
1.4.8+dfsg-2.1
fixed
stretch
not-affected
bookworm
1.5.4+dfsg2-5
fixed
sid
1.5.6+dfsg-1
fixed
trixie
1.5.6+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libzstd
noble
Fixed 1.4.8+dfsg-2build1
released
mantic
Fixed 1.4.8+dfsg-2build1
released
lunar
Fixed 1.4.8+dfsg-2build1
released
kinetic
Fixed 1.4.8+dfsg-2build1
released
jammy
Fixed 1.4.8+dfsg-2build1
released
impish
Fixed 1.4.8+dfsg-2build1
released
hirsute
Fixed 1.4.8+dfsg-2build1
released
groovy
Fixed 1.4.5+dfsg-4ubuntu0.1
released
focal
Fixed 1.4.4+dfsg-3ubuntu0.1
released
bionic
Fixed 1.3.3+dfsg-2ubuntu1.2
released
xenial
Fixed 1.3.1+dfsg-1~ubuntu0.16.04.1+esm3
released
trusty
dne