{"id":"CVE-2021-24031","aliases":["ALPINE-CVE-2021-24031","BELL-CVE-2021-24031","DEBIAN-CVE-2021-24031","DLA-2573-1","DSA-4850-1","EUVD-2021-10951","GHSA-5mqj-v3fr-pg3x","MGASA-2021-0322","SUSE-SU-2021:0948-1","UBUNTU-CVE-2021-24031","USN-4760-1","USN-5720-1","openSUSE-SU-2021:0481-1"],"status":"published","title":"In the Zstandard command-line utility prior to v1.4.1, output files were created with default...","description":"In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00465,"percentile":0.40609,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-276","CWE-277"],"published":"2021-02-10T00:00:00Z","modified":"2026-10-30T10:45:59Z","fixes":[{"ecosystem":"Alpine:v3.14","package":"zstd","fixed_in":["1.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"zstd","fixed_in":["1.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"zstd","fixed_in":["1.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"zstd","fixed_in":["1.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"zstd","fixed_in":["1.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"zstd","fixed_in":["1.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"zstd","fixed_in":["1.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"zstd","fixed_in":["1.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"zstd","fixed_in":["1.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"zstd","fixed_in":["1.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"zstd","fixed_in":["1.4.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libzstd","fixed_in":["1.4.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libzstd","fixed_in":["1.4.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libzstd","fixed_in":["1.4.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"libzstd","fixed_in":["1.1.2-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"libzstd","fixed_in":["1.3.8+dfsg-3+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"zstd","fixed_in":["1.4.0-1.1.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libzstd","fixed_in":["1.3.1+dfsg-1~ubuntu0.16.04.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libzstd","fixed_in":["1.3.3+dfsg-2ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libzstd","fixed_in":["1.4.4+dfsg-3ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libzstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libzstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libzstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"libzstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-1+deb9u1"}]}],"versions":["1.1.2-1"]},{"source":"osv","ecosystem":"Debian:10","package":"libzstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8+dfsg-3+deb10u1"}]}],"versions":["1.3.8+dfsg-3"]},{"source":"osv","ecosystem":"Mageia:7","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-1.1.mga7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libzstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1+dfsg-1~ubuntu0.16.04.1+esm3"}]}],"versions":["0.4.5-1","0.5.1-1","1.3.1+dfsg-1~ubuntu0.16.04.1","1.3.1+dfsg-1~ubuntu0.16.04.1+esm1","1.3.1+dfsg-1~ubuntu0.16.04.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libzstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3+dfsg-2ubuntu1.2"}]}],"versions":["1.3.1+dfsg-1","1.3.2+dfsg-1","1.3.2+dfsg2-1","1.3.3+dfsg-1","1.3.3+dfsg-1ubuntu1","1.3.3+dfsg-2ubuntu1","1.3.3+dfsg-2ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libzstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4+dfsg-3ubuntu0.1"}]}],"versions":["1.4.3+dfsg-1","1.4.4+dfsg-1","1.4.4+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libzstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3+dfsg-2ubuntu1.2"}]}],"versions":["1.3.1+dfsg-1","1.3.2+dfsg-1","1.3.2+dfsg2-1","1.3.3+dfsg-1","1.3.3+dfsg-1ubuntu1","1.3.3+dfsg-2ubuntu1","1.3.3+dfsg-2ubuntu1.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libzstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4+dfsg-3ubuntu0.1"}]}],"versions":["1.4.3+dfsg-1","1.4.4+dfsg-1","1.4.4+dfsg-3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libzstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1+dfsg-1~ubuntu0.16.04.1+esm3"}]}],"versions":["0.4.5-1","0.5.1-1","1.3.1+dfsg-1~ubuntu0.16.04.1","1.3.1+dfsg-1~ubuntu0.16.04.1+esm1","1.3.1+dfsg-1~ubuntu0.16.04.1+esm2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-lp152.2.3.1"}]}],"bundled":2}],"products":[{"vendor":"facebook","product":"zstandard"}],"references":[{"url":"https://github.com/facebook/zstd/issues/1630","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=981404","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Mailing List","Third Party Advisory","report"]},{"url":"https://www.facebook.com/security/advisories/cve-2021-24031","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-24031"},{"url":"https://github.com/advisories/GHSA-5mqj-v3fr-pg3x"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-24031","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-24031","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-24031","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0322.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28444","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4760-1","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210948-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1183370","tags":["report"]},{"url":"https://bugzilla.suse.com/1183371","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24032","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-24031","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5720-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-24031","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-24032","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HYCURYHE4SZBA5XWHE6FDNCJ3JJDZS5S/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-24031","description":"In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.","status":"published","published":"2021-03-04T20:15:21Z","modified":"2024-08-03T19:21:17.205Z","cwes":["CWE-277"],"updated_at":"2026-11-02T14:33:05.000797Z"}],"euvd":[{"id":"EUVD-2021-10951","description":"In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.","status":"published","published":"2021-03-04T20:15:21Z","modified":"2024-08-03T19:21:17Z","updated_at":"2026-11-03T03:24:59.661237Z"}],"ghsa":[{"id":"GHSA-5mqj-v3fr-pg3x","title":"In the Zstandard command-line utility prior to v1.4.1, output files were created with default...","description":"In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.","status":"published","published":"2022-05-24T17:43:40Z","modified":"2023-01-29T05:05:56Z","cwes":["CWE-276"],"updated_at":"2026-11-02T14:45:54.702484Z"}],"nvd":[{"id":"CVE-2021-24031","description":"In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.","status":"published","published":"2021-03-04T21:15:12.743Z","modified":"2026-06-17T03:39:11.537Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-277","CWE-276"],"updated_at":"2026-11-02T14:06:50.399901Z"}],"osv":[{"id":"ALPINE-CVE-2021-24031","description":"In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.","status":"published","published":"2021-03-04T21:15:12.743Z","modified":"2026-10-23T17:17:56.158775299Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"BELL-CVE-2021-24031","title":"CVE-2021-24031 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:13.243215Z","modified":"2026-09-04T07:15:03.325325952Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2021-24031","description":"In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.","status":"published","published":"2021-03-04T21:15:12.743Z","modified":"2026-10-30T10:45:59.29396713Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"DEBIAN-CVE-2021-24031","description":"In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.","status":"published","published":"2021-03-04T21:15:12.743Z","modified":"2026-10-23T18:02:52.308666469Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"UBUNTU-CVE-2021-24031","description":"In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.","status":"published","published":"2021-02-10T00:00:00Z","modified":"2026-04-22T12:49:42.327022Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"DLA-2573-1","title":"libzstd - security update","status":"published","published":"2021-02-20T00:00:00Z","modified":"2026-03-09T01:22:50.709311Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4850-1","title":"libzstd - security update","status":"published","published":"2021-02-10T00:00:00Z","modified":"2026-03-09T02:11:00.914958Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0322","title":"Updated zstd packages fix a security vulnerability","description":"In the Zstandard command-line utility prior to v1.4.1, output files were\ncreated with default permissions. Correct file permissions (matching the input)\nwould only be set at completion time. Output files could therefore be readable\nor writable to unintended parties (CVE-2021-24031).\n","status":"published","published":"2021-07-09T00:27:08Z","modified":"2026-04-16T04:43:52.589447283Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0481-1","title":"Security update for zstd","description":"This update for zstd fixes the following issues:\n\n- CVE-2021-24031: Added read permissions to files while being compressed or uncompressed (bsc#1183371).\n- CVE-2021-24032: Fixed a race condition which could have allowed an attacker to access world-readable destination file (bsc#1183370).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-03-27T19:04:47Z","modified":"2026-02-04T02:40:04.566388Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"SUSE-SU-2021:0948-1","title":"Security update for zstd","description":"This update for zstd fixes the following issues:\n\n- CVE-2021-24031: Added read permissions to files while being compressed or uncompressed (bsc#1183371).\n- CVE-2021-24032: Fixed a race condition which could have allowed an attacker to access world-readable destination file (bsc#1183370).\n","status":"published","published":"2021-03-24T13:31:47Z","modified":"2026-02-04T04:24:22.854492Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"USN-4760-1","title":"libzstd vulnerabilities","description":"It was discovered that libzstd incorrectly handled file permissions. A\nlocal attacker could possibly use this issue to access certain files,\ncontrary to expectations.\n","status":"published","published":"2021-03-08T18:21:54Z","modified":"2026-04-22T10:11:52.315119Z","updated_at":"2026-11-02T16:58:15.159055Z"},{"id":"USN-5720-1","title":"libzstd vulnerabilities","description":"It was discovered that Zstandard was not properly managing file\npermissions when generating output files. A local attacker could\npossibly use this issue to cause a race condition and gain\nunauthorized access to sensitive data.\n","status":"published","published":"2022-11-09T12:00:15Z","modified":"2026-06-25T13:31:32.696902035Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}