Mar 29, 2024

Started

• Closed✓Patched

  xz-utils backdoor (CVE-2024-3094)

  A maintainer persona, 'Jia Tan', slipped a backdoor into the release tarballs of XZ Utils 5.6.0 and 5.6.1. Through liblzma it targeted OpenSSH's sshd on distributions that link sshd against libsystemd, so a key holder could get unauthenticated remote code execution. Andres Freund spotted it after noticing SSH logins using a lot of CPU on Debian sid. It reached only bleeding-edge distributions such as Fedora 41/Rawhide and Debian unstable before it was caught.

  XZ Utils (liblzma)·Closed May 29, 2024·updated May 29, 2024