CVE-2021-24031

zstd: adds read permissions to files while being compressed or uncompressed

Loading…

Severity

Low

Red Hat Product Security

5.5

CVSS 3.1

Review impact separately from score.

Published · February 11, 2021

Updated · November 22, 2025

Description

A flaw was found in zstd. While the final file mode is reflective of the input file, when compressing or uncompressing, the file can temporarily gain greater permissions than the input and potentially leading to security issues (especially if large files are being handled).

Statement

In OpenShift Container Platform (OCP) the zstd package was delivered in OCP 4.3 which is already end of life.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-281 · Improper Preservation of Permissions