Beginning in v1.4.1 and prior to v1.4.9 due to an incomplete fix for CVE-2021-24031 the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.

🗓️ 30 Jul 2021 07:00:00Reported by MicrosoftType

mscve

mscve🔗 msrc.microsoft.com👁 4 Views

From 1.4.1 to 1.4.9, Zstandard outputs had default permissions due to an incomplete fix, briefly exposing data.

Reporter	Title	Published	Views	Family All 103
IBM Security Bulletins	Security Bulletin: A buffer overread, security restrictions bypass, a use-after-free, and other vulnerabilities might affect IBM Storage Defender – Resiliency Service	25 Mar 202523:50	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in zstd affects IBM Netezza Appliance	10 Aug 202608:53	–	ibm
ATTACKERKB	CVE-2021-24032	4 Mar 202121:15	–	attackerkb
ATTACKERKB	CVE-2021-24031	4 Mar 202121:15	–	attackerkb
AlpineLinux	CVE-2021-24031	4 Mar 202120:15	–	alpinelinux
AlpineLinux	CVE-2021-24032	4 Mar 202120:15	–	alpinelinux
AstraLinux	Astra Linux – Vulnerability in libzstd	20 May 202605:53	–	astralinux
AstraLinux	Astra Linux – Vulnerability in libzstd	20 May 202605:53	–	astralinux
BDU FSTEC	The vulnerability of the Zstandard data compression library, related to the default access rights settings, allows attackers to gain access to confidential data.	14 Nov 202300:00	–	bdu_fstec
CBLMariner	CVE-2021-24032 affecting package ceph for versions less than 18.2.2-5	13 Mar 202500:00	–	cbl_mariner

Vulners

Node

OR

microsoft azl3_ceph_18.2.2-8Range<18.2.2-5

microsoft cbl2_ceph_16.2.10-7Range<16.2.10-3

microsoft azl3_ceph_18.2.2-5Range<18.2.2-5

microsoft cbl2_ceph_16.2.10-3Range<16.2.10-3

microsoft cm1_zstd_1.4.9-1Range<1.4.9-1

microsoft cbl2_ceph_16.2.10-7Range<16.2.10-3

microsoft ceph_prometheus_alerts_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_grafana_dashboards_16.2.10_3.cm2Range<16.2.10-3

microsoft rados_objclass_devel_16.2.10_3.cm2Range<16.2.10-3

microsoft python3_ceph_common_16.2.10_3.cm2Range<16.2.10-3

microsoft python3_ceph_argparse_16.2.10_3.cm2Range<16.2.10-3

microsoft python3_cephfs_16.2.10_3.cm2Range<16.2.10-3

microsoft libcephfs_devel_16.2.10_3.cm2Range<16.2.10-3

microsoft libcephfs2_16.2.10_3.cm2Range<16.2.10-3

microsoft python3_rbd_16.2.10_3.cm2Range<16.2.10-3

microsoft librbd_devel_16.2.10_3.cm2Range<16.2.10-3

microsoft librbd1_16.2.10_3.cm2Range<16.2.10-3

microsoft libradosstriper_devel_16.2.10_3.cm2Range<16.2.10-3

microsoft libradosstriper1_16.2.10_3.cm2Range<16.2.10-3

microsoft python3_rados_16.2.10_3.cm2Range<16.2.10-3

microsoft python3_rgw_16.2.10_3.cm2Range<16.2.10-3

microsoft librgw_devel_16.2.10_3.cm2Range<16.2.10-3

microsoft librgw2_16.2.10_3.cm2Range<16.2.10-3

microsoft libradospp_devel_16.2.10_3.cm2Range<16.2.10-3

microsoft librados_devel_16.2.10_3.cm2Range<16.2.10-3

microsoft librados2_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_osd_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_radosgw_16.2.10_3.cm2Range<16.2.10-3

microsoft rbd_nbd_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_immutable_object_cache_16.2.10_3.cm2Range<16.2.10-3

microsoft rbd_mirror_16.2.10_3.cm2Range<16.2.10-3

microsoft rbd_fuse_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_fuse_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_mgr_cephadm_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_mgr_k8sevents_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_mgr_rook_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_mgr_modules_core_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_mgr_dashboard_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_mgr_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_mon_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_mds_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_common_16.2.10_3.cm2Range<16.2.10-3

microsoft cephadm_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_base_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_prometheus_alerts_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_grafana_dashboards_16.2.10_3.cm2Range<16.2.10-3

microsoft rados_objclass_devel_16.2.10_3.cm2Range<16.2.10-3

microsoft python3_ceph_common_16.2.10_3.cm2Range<16.2.10-3

microsoft python3_ceph_argparse_16.2.10_3.cm2Range<16.2.10-3

microsoft python3_cephfs_16.2.10_3.cm2Range<16.2.10-3

microsoft libcephfs_devel_16.2.10_3.cm2Range<16.2.10-3

microsoft libcephfs2_16.2.10_3.cm2Range<16.2.10-3

microsoft python3_rbd_16.2.10_3.cm2Range<16.2.10-3

microsoft librbd_devel_16.2.10_3.cm2Range<16.2.10-3

microsoft librbd1_16.2.10_3.cm2Range<16.2.10-3

microsoft libradosstriper_devel_16.2.10_3.cm2Range<16.2.10-3

microsoft libradosstriper1_16.2.10_3.cm2Range<16.2.10-3

microsoft python3_rados_16.2.10_3.cm2Range<16.2.10-3

microsoft python3_rgw_16.2.10_3.cm2Range<16.2.10-3

microsoft librgw_devel_16.2.10_3.cm2Range<16.2.10-3

microsoft librgw2_16.2.10_3.cm2Range<16.2.10-3

microsoft libradospp_devel_16.2.10_3.cm2Range<16.2.10-3

microsoft librados_devel_16.2.10_3.cm2Range<16.2.10-3

microsoft librados2_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_osd_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_radosgw_16.2.10_3.cm2Range<16.2.10-3

microsoft rbd_nbd_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_immutable_object_cache_16.2.10_3.cm2Range<16.2.10-3

microsoft rbd_mirror_16.2.10_3.cm2Range<16.2.10-3

microsoft rbd_fuse_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_fuse_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_mgr_cephadm_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_mgr_k8sevents_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_mgr_rook_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_mgr_modules_core_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_mgr_dashboard_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_mgr_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_mon_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_mds_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_common_16.2.10_3.cm2Range<16.2.10-3

microsoft cephadm_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_base_16.2.10_3.cm2Range<16.2.10-3

microsoft ceph_16.2.10_3.cm2Range<16.2.10-3

microsoft zstd_debuginfo_1.4.9_1.cm1Range<1.4.9-1

microsoft zstd_doc_1.4.9_1.cm1Range<1.4.9-1

microsoft zstd_libs_1.4.9_1.cm1Range<1.4.9-1

microsoft zstd_devel_1.4.9_1.cm1Range<1.4.9-1

microsoft zstd_1.4.9_1.cm1Range<1.4.9-1

microsoft zstd_debuginfo_1.4.9_1.cm1Range<1.4.9-1

microsoft zstd_doc_1.4.9_1.cm1Range<1.4.9-1

microsoft zstd_libs_1.4.9_1.cm1Range<1.4.9-1

microsoft zstd_devel_1.4.9_1.cm1Range<1.4.9-1

microsoft zstd_1.4.9_1.cm1Range<1.4.9-1

13 Aug 2026 05:10Current

4.9Medium risk

Vulners AI Score4.9

CVSS 22.1

CVSS 3.14.7 - 5.5

EPSS0.00431

default permissions output files incomplete fix security flaw vulnerability