CVE-2021-24032CWE-276CWE-277

CVE-2021-24032

Medium · published March 5, 2021

CVSS v3.1
4.7
EPSS
0%
Percentile
27.2
In the wild
Unconfirmed
What it is

Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00348 · 27.2th percentile
Weaknesses
CWE-276 · Incorrect Default Permissions; CWE-277 · Insecure Inherited Permissions
Published
2021-03-05T02:15Z
Affected products (1)
ProductVersionsFixed in
facebook/zstandard≥ 1.4.1, < 1.4.91.4.9
References (6)
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982519 · [email protected]https://github.com/facebook/zstd/issues/2491 · [email protected]https://www.facebook.com/security/advisories/cve-2021-24032 · [email protected]https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982519 · af854a3a-2127-422b-91ae-364da2661108https://github.com/facebook/zstd/issues/2491 · af854a3a-2127-422b-91ae-364da2661108https://www.facebook.com/security/advisories/cve-2021-24032 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 04 MAR 20:15Z
    Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default…
    cvelistv5