Vulnerability in Facebook Zstandard
CVE-2021-24031
In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.
EPSS: 0.004 (35.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Facebook Zstandard — versions 1.4.1, unspecified
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve-assign@fb.com (Exploit, Third Party Advisory, x_refsource_MISC, Issue Tracking)
- cve-assign@fb.com (Exploit, Mailing List, Third Party Advisory, x_refsource_MISC, Issue Tracking)
- cve-assign@fb.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-24031?
- CVE-2021-24031 is a medium-severity vulnerability in Facebook Zstandard, classified under Insecure Inherited Permissions. CVSS score: 5.5/10. Published 2021-03-04.
- How severe is CVE-2021-24031?
- Medium severity. CVSS v3 base score is 5.5 out of 10.
- Is CVE-2021-24031 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.