| Description |
| - |
A security issue was found in zstd before version 1.4.9. During compression and decompression, files were created with the default umask before tightening the file permissions to 0600. By exploiting this race condition, attackers could read or write files they would otherwise not be allowed to access. |
| + |
Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties. |
|