Unrated
In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the inpu...
CVE-2021-24031
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2021-24031 zstd Fixed in: 1.4.1-r0
- BellSoft Alpaquita BELL-CVE-2021-24031
- Debian DEBIAN-CVE-2021-24031 libzstd Fixed in: 1.4.8+dfsg-1
Original description The description as published by the source.
In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.
References
- advisory facebook.com
- report bugs.debian.org
- report github.com