CVEvulnerability
CVE-2021-24031
5.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-03-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-276, CWE-277
Description
In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.
Affected configurations
• facebook zstandard (< 1.4.1)
Related
References
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=981404 Exploit, Issue Tracking, Mailing List, Third Party Advisory
- https://github.com/facebook/zstd/issues/1630 Exploit, Issue Tracking, Third Party Advisory
- https://www.facebook.com/security/advisories/cve-2021-24031 Vendor Advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=981404 Exploit, Issue Tracking, Mailing List, Third Party Advisory
- https://github.com/facebook/zstd/issues/1630 Exploit, Issue Tracking, Third Party Advisory
- https://www.facebook.com/security/advisories/cve-2021-24031 Vendor Advisory