CVE-2021-24031

2021-02-1000:00:00

ubuntu.com

zstandard

v1.4.1

output files

permissions

sensitive data

unintended parties

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

26.6%

JSON

In the Zstandard command-line utility prior to v1.4.1, output files were
created with default permissions. Correct file permissions (matching the
input) would only be set at completion time. Output files could therefore
be readable or writable to unintended parties.

Bugs

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchlibzstd< 1.3.3+dfsg-2ubuntu1.2UNKNOWN
ubuntu20.04noarchlibzstd< 1.4.4+dfsg-3ubuntu0.1UNKNOWN
ubuntu20.10noarchlibzstd< 1.4.5+dfsg-4ubuntu0.1UNKNOWN
ubuntu16.04noarchlibzstd< 1.3.1+dfsg-1~ubuntu0.16.04.1+esm3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	libzstd	< 1.3.3+dfsg-2ubuntu1.2	UNKNOWN
ubuntu	20.04	noarch	libzstd	< 1.4.4+dfsg-3ubuntu0.1	UNKNOWN
ubuntu	20.10	noarch	libzstd	< 1.4.5+dfsg-4ubuntu0.1	UNKNOWN
ubuntu	16.04	noarch	libzstd	< 1.3.1+dfsg-1~ubuntu0.16.04.1+esm3	UNKNOWN