MediumFix available
libzstd — security advisory
In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.
- Products
- libzstd
- Affected versions
- Not specified
- Fixed versions
- 1.4.8+dfsg-1
- CVEs
- CVE-2021-24031
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 00:02 UTC · Revision 1
Source evidence
In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.
osv:DEBIAN-CVE-2021-24031
libzstd
Fixed versions: 1.4.8+dfsg-1
libzstd
Fixed versions: 1.4.8+dfsg-1
libzstd
Fixed versions: 1.4.8+dfsg-1
Complete source record
{
"id": "58b06baf7e25006a52088df2e05ba1776617975a218d513cde2a543698728dbc",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2021-24031",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2021-24031",
"summary": "In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.",
"evidence": "osv:DEBIAN-CVE-2021-24031",
"products": [
{
"name": {
"value": "libzstd",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.4.8+dfsg-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libzstd",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.4.8+dfsg-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libzstd",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.4.8+dfsg-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2021-24031",
"aliases": [
"DEBIAN-CVE-2021-24031"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.8+dfsg-1"
}
]
}
],
"package": {
"name": "libzstd",
"purl": "pkg:deb/debian/libzstd?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-24031.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.8+dfsg-1"
}
]
}
],
"package": {
"name": "libzstd",
"purl": "pkg:deb/debian/libzstd?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-24031.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.8+dfsg-1"
}
]
}
],
"package": {
"name": "libzstd",
"purl": "pkg:deb/debian/libzstd?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-24031.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T18:02:52.308666469Z",
"provider": "osv",
"upstream": [
"CVE-2021-24031"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2021-24031"
]
},
"related_cves": [
{
"value": "CVE-2021-24031",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 419768,
"published_at": "2021-03-04T21:15:12.743+00:00"
}