Read the docs
TI-2021-06349 Aliases CVE-2021-24032GHSA-ffqj-7pgc-cmj5

Incorrect default permissions in Meta Zstandard

Priority LOW 22CWE-277Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 fixed, 5 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00348 28th percentileScored 2026-11-07
Fix Partial Zstandard (Facebook): 1.4.9Red Hat: 1 advisoryRed Hat: 1 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MetaZstandard1.4.1 and later1.4.9Patch availableCNA
  • Zstandard VendorMeta Affected 1.4.1 and later Fixed in 1.4.9 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:facebook:zstandard:*:*:*:*:*:*:*:*1.4.1 to before 1.4.9VulnerableMeta
  • cpe:2.3:a:facebook:zstandard:*:*:*:*:*:*:*:* Versions 1.4.1 to before 1.4.9 Vulnerable ·Meta

Remediation

  • Fix · CNA Zstandard (Facebook) Fixed in 1.4.9

Red Hat 1 advisory

  • RHSA-2024:3527 Released 2024-05-30 · Red Hat rating Moderate
    Red Hat AMQ Streams 2.7.0 release and security update
    • Red Hat AMQ Streams 2.7.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Facebook Zstandard 1.4.1, unspecified

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2021-06348 Incorrect default permissions in Meta ZstandardPriority LOW 25
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Security 3AffectedNo fix yet
Red Hat Ceph Storage 3AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 7AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Out of support scope
Red Hat AMQ Streams 2.7.0Fixed RHSA-2024:3527
Not affected: 2 products
  • Red Hat Enterprise Linux 9
  • Red Hat OpenStack Platform 16.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24032
  2. 2026-10-03 Alias added: GHSA-ffqj-7pgc-cmj5
  3. 2026-10-08 CISA SSVC decision points changed

References

Patch 2

Advisory 1

  • TI-2022-04490 Uncontrolled resource consumption in zstd CVSS 3.1HIGH 7.5
  • TI-2019-08927 Race condition in Meta Zstandard CVSS 3.0HIGH 8.1
  • TI-2021-06348 Incorrect default permissions in Meta Zstandard CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences