Bugzilla – Bug 1183370
VUL-0: CVE-2021-24032: zstd: Race condition allows attacker to access world-readable destination file
Last modified: 2021-08-06 12:36:23 UTC
rh#1928090 While the final file mode is reflective of the input file, when compressing or uncompressing, the file can temporarily gain greater permissions than the input and potentially leading to security issues (especially if large files are being handled). References: https://github.com/facebook/zstd/issues/2491 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982519 https://github.com/facebook/zstd/issues/1630 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=981404 References: https://bugzilla.redhat.com/show_bug.cgi?id=1928090 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-24032 https://access.redhat.com/security/cve/CVE-2021-24032 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24032 https://github.com/facebook/zstd/issues/2491 https://www.facebook.com/security/advisories/cve-2021-24032 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982519
patch for this one CVE-2021-24032: https://github.com/facebook/zstd/pull/2495/files
tracking as affected: SUSE:SLE-15:Update/zstd
SUSE-SU-2021:0948-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 1183370,1183371 CVE References: CVE-2021-24031,CVE-2021-24032 JIRA References: Sources used: SUSE MicroOS 5.0 (src): zstd-1.4.4-1.6.1 SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): zstd-1.4.4-1.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2021:0481-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 1183370,1183371 CVE References: CVE-2021-24031,CVE-2021-24032 JIRA References: Sources used: openSUSE Leap 15.2 (src): zstd-1.4.4-lp152.2.3.1