Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

← Past incidents
ClosedCriticalPatched

xz-utils backdoor (CVE-2024-3094)

XZ Utils (liblzma)

A maintainer persona, 'Jia Tan', slipped a backdoor into the release tarballs of XZ Utils 5.6.0 and 5.6.1. Through liblzma it targeted OpenSSH's sshd on distributions that link sshd against libsystemd, so a key holder could get unauthenticated remote code execution. Andres Freund spotted it after noticing SSH logins using a lot of CPU on Debian sid. It reached only bleeding-edge distributions such as Fedora 41/Rawhide and Debian unstable before it was caught.

Why this severity: Red Hat rating Critical; supply-chain backdoor

Started
Mar 29, 2024
Closed
May 29, 2024
CVE
CVE-2024-3094

Affected

  • 5.6.0
  • 5.6.1

Fixed in

  • Downgrade to an uncompromised version such as 5.4.6 Stable (CISA)
  • 5.6.2 clean release (2024-05-29, tukaani.org)

Updates by day6

▸May 29, 2024

Link #

  1. Lasse Collin publishes review notes 1.0 and new clean XZ Utils releases

    Source

▸Apr 9, 2024

Link #

  1. XZ Git repositories available on GitHub again

    Source

▸Mar 30, 2024

Link #

  1. xz@tukaani.org stops forwarding to Jia Tan

    Source

▸Mar 29, 2024

Link #

  1. Andres Freund discloses the backdoor on oss-security

    Source

  2. CISA alert: downgrade XZ Utils to an uncompromised version such as 5.4.6

    Source

  3. Red Hat urgent security alert for Fedora 41 and Rawhide users

    Source

Advisories4

News & write-ups1

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo