{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "xz-utils backdoor (CVE-2024-3094) · updates",
  "home_page_url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094",
  "feed_url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094/feed.json",
  "description": "A maintainer persona, 'Jia Tan', slipped a backdoor into the release tarballs of XZ Utils 5.6.0 and 5.6.1. Through liblzma it targeted OpenSSH's sshd on distributions that link sshd against libsystemd, so a key holder could get unauthenticated remote code execution. Andres Freund spotted it after noticing SSH logins using a lot of CPU on Debian sid. It reached only bleeding-edge distributions such as Fedora 41/Rawhide and Debian unstable before it was caught.",
  "language": "en",
  "_pwn": {
    "slug": "xz-utils-backdoor-cve-2024-3094",
    "severity": "critical",
    "status": "closed",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094/feed.xml",
    "llms": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094/llms.txt",
    "json": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094#2024-05-29-bfbc6192",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094#2024-05-29-bfbc6192",
      "title": "xz-utils backdoor (CVE-2024-3094): Lasse Collin publishes review notes 1.0 and new clean XZ Utils releases",
      "content_text": "xz-utils backdoor (CVE-2024-3094): Lasse Collin publishes review notes 1.0 and new clean XZ Utils releases\n\nSource: https://tukaani.org/xz-backdoor/",
      "date_published": "2024-05-29T00:00:00.000Z",
      "external_url": "https://tukaani.org/xz-backdoor/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094#2024-04-09-28f74d4f",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094#2024-04-09-28f74d4f",
      "title": "xz-utils backdoor (CVE-2024-3094): XZ Git repositories available on GitHub again",
      "content_text": "xz-utils backdoor (CVE-2024-3094): XZ Git repositories available on GitHub again\n\nSource: https://tukaani.org/xz-backdoor/",
      "date_published": "2024-04-09T00:00:00.000Z",
      "external_url": "https://tukaani.org/xz-backdoor/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094#2024-03-30-602dad30",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094#2024-03-30-602dad30",
      "title": "xz-utils backdoor (CVE-2024-3094): xz@tukaani.org stops forwarding to Jia Tan",
      "content_text": "xz-utils backdoor (CVE-2024-3094): xz@tukaani.org stops forwarding to Jia Tan\n\nSource: https://tukaani.org/xz-backdoor/",
      "date_published": "2024-03-30T00:00:00.000Z",
      "external_url": "https://tukaani.org/xz-backdoor/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094#2024-03-29-fb830b36",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094#2024-03-29-fb830b36",
      "title": "xz-utils backdoor (CVE-2024-3094): Andres Freund discloses the backdoor on oss-security",
      "content_text": "xz-utils backdoor (CVE-2024-3094): Andres Freund discloses the backdoor on oss-security\n\nSource: https://www.openwall.com/lists/oss-security/2024/03/29/4",
      "date_published": "2024-03-29T00:00:00.000Z",
      "external_url": "https://www.openwall.com/lists/oss-security/2024/03/29/4",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094#2024-03-29-1a2e2724",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094#2024-03-29-1a2e2724",
      "title": "xz-utils backdoor (CVE-2024-3094): CISA alert: downgrade XZ Utils to an uncompromised version such as 5.4.6",
      "content_text": "xz-utils backdoor (CVE-2024-3094): CISA alert: downgrade XZ Utils to an uncompromised version such as 5.4.6\n\nSource: https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094",
      "date_published": "2024-03-29T00:00:00.000Z",
      "external_url": "https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094#2024-03-29-da80b886",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094#2024-03-29-da80b886",
      "title": "xz-utils backdoor (CVE-2024-3094): Red Hat urgent security alert for Fedora 41 and Rawhide users",
      "content_text": "xz-utils backdoor (CVE-2024-3094): Red Hat urgent security alert for Fedora 41 and Rawhide users\n\nSource: https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users",
      "date_published": "2024-03-29T00:00:00.000Z",
      "external_url": "https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users",
      "tags": [
        "critical"
      ]
    }
  ]
}