CVE-2019-11922: facebook zstandard Race Condition
CVSS: 8.1v3.0HighModified
AliasesALPINE-CVE-2019-11922MGASA-2019-0257openSUSE-SU-2019:2008-1UBUNTU-CVE-2019-11922USN-4108-1USN-5593-1DEBIAN-CVE-2019-11922openSUSE-SU-2019:1845-1openSUSE-SU-2019:1952-1openSUSE-SU-2024:11544-1
Published 25-07-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-11922 is a high (CVSS 8.1) Race Condition vulnerability in facebook zstandard. EPSS estimates a 1.42% chance of exploitation in the next 30 days, higher than 72.4% of scored vulnerabilities.
CVSS score
8.1/10
010
High · v3.0 (NVD)EPSS score
1.42%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 25-07-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.
CVSS metrics
5 scores · 4 sources · 2 versionsHigh 8.1Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
1.42%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
0.00 pp
From 1.42% on 19-09-2026
19-09-202619-10-2026
EPSS score1.42%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Opensuse3 products
- zstd&distro=openSUSE Leap 15.0< 1.4.2-lp150.2.3.1
- zstd&distro=openSUSE Leap 15.1< 1.4.2-lp151.3.3.1
- zstd&distro=openSUSE Tumbleweed< 1.5.0-1.13
Suse2 products
- zstd&distro=SUSE Package Hub 15< 1.4.2-bp151.4.3.1
- zstd&distro=SUSE Package Hub 15 SP1< 1.4.2-bp151.4.3.1
Alpine1 product
- zstd< 1.3.8-r0
Debian1 product
- libzstd< 1.3.8+dfsg-2
Facebook1 product
- zstandard1.3.8 | ≥ unspecified, < 1.3.8 | < 1.3.8
Mageia1 product
- zstd< 1.3.8-1.mga6
Ubuntu1 product
- libzstd< 1.3.3+dfsg-2ubuntu1.1 | < 1.3.1+dfsg-1~ubuntu0.16.04.1+esm2
7 vendors · 10 products
References
22 links- www.oracle.com/security-alerts/cpuoct2020.htmlX Refsource MISC
- github.com/facebook/zstd/pull/1404/commits/3e5cdf1b6a85843e991d7d10f6a2567c15580da0X Refsource MISCPatchThird Party AdvisoryREPORT
Show all 22 references
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory