{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T18:02:57.453Z",
  "tag": {
    "id": "backdoor",
    "label": "Backdoor",
    "isStack": false,
    "url": "https://pwn.watch/t/backdoor",
    "feed": "https://pwn.watch/t/backdoor/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "xz-utils-backdoor-cve-2024-3094",
      "title": "xz-utils backdoor (CVE-2024-3094)",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094",
      "json": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "XZ Utils (liblzma)",
      "tags": [
        "linux",
        "xz-utils",
        "openssh",
        "supply-chain",
        "backdoor",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-3094"
      ],
      "affectedVersions": [
        "5.6.0",
        "5.6.1"
      ],
      "fixedVersions": [
        "Downgrade to an uncompromised version such as 5.4.6 Stable (CISA)",
        "5.6.2 clean release (2024-05-29, tukaani.org)"
      ],
      "startedAt": "2024-03-29",
      "closedAt": "2024-05-29",
      "updatedAt": "2024-05-29",
      "summary": "A maintainer persona, 'Jia Tan', slipped a backdoor into the release tarballs of XZ Utils 5.6.0 and 5.6.1. Through liblzma it targeted OpenSSH's sshd on distributions that link sshd against libsystemd, so a key holder could get unauthenticated remote code execution. Andres Freund spotted it after noticing SSH logins using a lot of CPU on Debian sid. It reached only bleeding-edge distributions such as Fedora 41/Rawhide and Debian unstable before it was caught.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "xz-utils-backdoor-cve-2024-3094",
      "incidentTitle": "xz-utils backdoor (CVE-2024-3094)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-05-29",
      "title": "Lasse Collin publishes review notes 1.0 and new clean XZ Utils releases",
      "body": null,
      "sourceUrl": "https://tukaani.org/xz-backdoor/",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094"
    },
    {
      "incident": "xz-utils-backdoor-cve-2024-3094",
      "incidentTitle": "xz-utils backdoor (CVE-2024-3094)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-09",
      "title": "XZ Git repositories available on GitHub again",
      "body": null,
      "sourceUrl": "https://tukaani.org/xz-backdoor/",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094"
    },
    {
      "incident": "xz-utils-backdoor-cve-2024-3094",
      "incidentTitle": "xz-utils backdoor (CVE-2024-3094)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-30",
      "title": "xz@tukaani.org stops forwarding to Jia Tan",
      "body": null,
      "sourceUrl": "https://tukaani.org/xz-backdoor/",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094"
    },
    {
      "incident": "xz-utils-backdoor-cve-2024-3094",
      "incidentTitle": "xz-utils backdoor (CVE-2024-3094)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-29",
      "title": "Andres Freund discloses the backdoor on oss-security",
      "body": null,
      "sourceUrl": "https://www.openwall.com/lists/oss-security/2024/03/29/4",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094"
    },
    {
      "incident": "xz-utils-backdoor-cve-2024-3094",
      "incidentTitle": "xz-utils backdoor (CVE-2024-3094)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-29",
      "title": "CISA alert: downgrade XZ Utils to an uncompromised version such as 5.4.6",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094"
    },
    {
      "incident": "xz-utils-backdoor-cve-2024-3094",
      "incidentTitle": "xz-utils backdoor (CVE-2024-3094)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-29",
      "title": "Red Hat urgent security alert for Fedora 41 and Rawhide users",
      "body": null,
      "sourceUrl": "https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094"
    }
  ]
}