Beginning in v1.4.1 and prior to v1.4.9 due to an incomplete fix for CVE-2021-24031 the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.

🗓️ 30 Jul 2021 07:00:00Reported by MicrosoftType

mscve

mscve🔗 msrc.microsoft.com👁 1 Views

From 1.4.1 to 1.4.9, Zstandard outputs had default permissions due to an incomplete fix, briefly exposing data.

Reporter	Title	Published	Views	Family All 101
IBM Security Bulletins	Security Bulletin: A buffer overread, security restrictions bypass, a use-after-free, and other vulnerabilities might affect IBM Storage Defender – Resiliency Service	25 Mar 202523:50	–	ibm
AlpineLinux	CVE-2021-24031	4 Mar 202120:15	–	alpinelinux
AlpineLinux	CVE-2021-24032	4 Mar 202120:15	–	alpinelinux
AstraLinux	Astra Linux - уязвимость в libzstd	20 May 202605:53	–	astralinux
AstraLinux	Astra Linux - уязвимость в libzstd	3 May 202623:59	–	astralinux
CBLMariner	CVE-2021-24032 affecting package ceph for versions less than 18.2.2-5	13 Mar 202500:00	–	cbl_mariner
CBLMariner	CVE-2021-24032 affecting package ceph for versions less than 16.2.10-3	16 May 202420:39	–	cbl_mariner
CBLMariner	CVE-2021-24032 affecting package zstd 1.4.4-1	9 Sep 202115:02	–	cbl_mariner
Cloud Foundry	USN-4760-1: libzstd vulnerabilities \| Cloud Foundry	22 Mar 202100:00	–	cloudfoundry
CNNVD	Zstandard 安全漏洞	4 Mar 202100:00	–	cnnvd

Vulners

Node

microsoft azl3_ceph_18.2.2-8Range<18.2.2-5

OR

microsoft cbl2_ceph_16.2.10-7Range<16.2.10-3

OR

microsoft azl3_ceph_18.2.2-5Range<18.2.2-5

OR

microsoft cbl2_ceph_16.2.10-3Range<16.2.10-3

OR

microsoft cm1_zstd_1.4.9-1Range<1.4.9-1

OR

microsoft ceph_prometheus_alerts_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_grafana_dashboards_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft rados_objclass_devel_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft python3_ceph_common_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft python3_ceph_argparse_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft python3_cephfs_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft libcephfs_devel_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft libcephfs2_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft python3_rbd_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft librbd_devel_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft librbd1_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft libradosstriper_devel_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft libradosstriper1_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft python3_rados_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft python3_rgw_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft librgw_devel_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft librgw2_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft libradospp_devel_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft librados_devel_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft librados2_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_osd_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_radosgw_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft rbd_nbd_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_immutable_object_cache_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft rbd_mirror_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft rbd_fuse_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_fuse_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_mgr_cephadm_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_mgr_k8sevents_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_mgr_rook_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_mgr_modules_core_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_mgr_dashboard_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_mgr_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_mon_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_mds_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_common_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft cephadm_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_base_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_prometheus_alerts_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_grafana_dashboards_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft rados_objclass_devel_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft python3_ceph_common_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft python3_ceph_argparse_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft python3_cephfs_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft libcephfs_devel_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft libcephfs2_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft python3_rbd_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft librbd_devel_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft librbd1_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft libradosstriper_devel_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft libradosstriper1_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft python3_rados_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft python3_rgw_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft librgw_devel_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft librgw2_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft libradospp_devel_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft librados_devel_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft librados2_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_osd_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_radosgw_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft rbd_nbd_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_immutable_object_cache_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft rbd_mirror_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft rbd_fuse_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_fuse_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_mgr_cephadm_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_mgr_k8sevents_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_mgr_rook_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_mgr_modules_core_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_mgr_dashboard_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_mgr_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_mon_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_mds_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_common_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft cephadm_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_base_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft ceph_16.2.10_3.cm2Range<16.2.10-3

OR

microsoft zstd_debuginfo_1.4.9_1.cm1Range<1.4.9-1

OR

microsoft zstd_doc_1.4.9_1.cm1Range<1.4.9-1

OR

microsoft zstd_libs_1.4.9_1.cm1Range<1.4.9-1

OR

microsoft zstd_devel_1.4.9_1.cm1Range<1.4.9-1

OR

microsoft zstd_1.4.9_1.cm1Range<1.4.9-1

OR

microsoft zstd_debuginfo_1.4.9_1.cm1Range<1.4.9-1

OR

microsoft zstd_doc_1.4.9_1.cm1Range<1.4.9-1

OR

microsoft zstd_libs_1.4.9_1.cm1Range<1.4.9-1

OR

microsoft zstd_devel_1.4.9_1.cm1Range<1.4.9-1

OR

microsoft zstd_1.4.9_1.cm1Range<1.4.9-1

18 Feb 2026 22:35Current

5.6Medium risk

Vulners AI Score5.6

CVSS 22.1

CVSS 3.14.7 - 5.5

EPSS0.00063

default permissions output files incomplete fix security flaw vulnerability