PT-2021-15655 · Facebook+5 · Zstandard+5

Delafond · Published 2021-02-20 · Updated 2026-04-15 · CVE-2021-24032

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Zstandard command-line utility versions 1.4.1 through 1.4.9

Description: The issue arises from an incomplete fix, resulting in output files being created with default permissions before being restricted. This momentary lapse allows unintended parties to potentially read or write to these files.

Recommendations: For versions 1.4.1 through 1.4.9, consider updating to a version that fully addresses the issue, ensuring output files are created with appropriate permissions from the outset, thus preventing unintended access.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-277

CWE-276

Related Identifiers

ALT-PU-2021-2105

ALT-PU-2021-2227

ALT-PU-2021-2331

AZL-38944

AZL-39352

CVE-2021-24032

DSA-4859-1

JLSEC-2026-121

MGASA-2021-0323

OESA-2021-1094

OPENSUSE-SU-2021:0481-1

OPENSUSE-SU-2021_0481-1

SUSE-SU-2021:0948-1

USN-4760-1

USN-5720-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Suse

Ubuntu

Zstandard

References · 36

• https://github.com/facebook/zstd/issues/2491 · Patch
• https://osv.dev/vulnerability/OESA-2021-1094 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5720-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4859-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0481-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0948-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-38944 · Vendor Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982519 · Patch
• https://osv.dev/vulnerability/ALPINE-CVE-2021-24032 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0323.html · Security Note
• https://osv.dev/vulnerability/USN-5720-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4760-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24032 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24032 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-24032 · Security Note