https://pwn.watch/t/xz-utils Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Wed, 29 May 2024 00:00:00 GMT https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094 https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094 Wed, 29 May 2024 00:00:00 GMT critical <p>A maintainer persona, 'Jia Tan', slipped a backdoor into the release tarballs of XZ Utils 5.6.0 and 5.6.1. Through liblzma it targeted OpenSSH's sshd on distributions that link sshd against libsystemd, so a key holder could get unauthenticated remote code execution. Andres Freund spotted it after noticing SSH logins using a lot of CPU on Debian sid. It reached only bleeding-edge distributions such as Fedora 41/Rawhide and Debian unstable before it was caught.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> Downgrade to an uncompromised version such as 5.4.6 Stable (CISA), 5.6.2 clean release (2024-05-29, tukaani.org)</p> <p><strong>Latest updates:</strong></p><ul><li>2024-05-29: Lasse Collin publishes review notes 1.0 and new clean XZ Utils releases (<a href="https://tukaani.org/xz-backdoor/">source</a>)</li><li>2024-04-09: XZ Git repositories available on GitHub again (<a href="https://tukaani.org/xz-backdoor/">source</a>)</li><li>2024-03-30: xz@tukaani.org stops forwarding to Jia Tan (<a href="https://tukaani.org/xz-backdoor/">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2024-3094</p>