Back Porta del darrere de XZ Utils Catalan Zadní vrátka v XZ Utils Czech XZ Utils Backdoor German Ataque por puerta trasera a XZ Utils Spanish Attaque de XZ Utils par porte dérobée French XZ Utilsのバックドア Japanese XZ Utils 백도어 Korean Бэкдор в XZ Russian XZ Utils backdoor SIMPLE XZ Utils backdoor Albanian

XZ Utils backdoor

XZ Utils backdoor
Previous XZ logo contributed by Jia Tan
CVE identifier(s)CVE-2024-3094
Date discoveredat or before 27 March 2024 (2024-03-27)[1][2]
Date of public disclosure29 March 2024 (2024-03-29)
Date patched29 March 2024 (2024-03-29)[a][3]
DiscovererAndres Freund
Affected softwarexz / liblzma library
Websitetukaani.org/xz-backdoor/

In February 2024, a malicious backdoor was introduced to the Linux build of the xz utility within the liblzma library in versions 5.6.0 and 5.6.1 by an account using the name "Jia Tan".[b][4] The backdoor gives an attacker who possesses a specific Ed448 private key remote code execution through OpenSSH on the affected Linux system. The issue has been given the Common Vulnerabilities and Exposures number CVE-2024-3094 and has been assigned a CVSS score of 10.0, the highest possible score.[5]

While xz is commonly present in most Linux distributions, at the time of discovery the backdoored version had not yet been widely deployed to production systems, but was present in development versions of major distributions.[6] The backdoor was discovered by the software developer Andres Freund, who announced his findings on 29 March 2024.[7]

  1. ^ "Understanding Red Hat's response to the XZ security incident". Retrieved 4 November 2024.
  2. ^ Oxide and Friends 4/8/2024 -- Discovering the XZ Backdoor with Andres Freund. Retrieved 4 November 2024.
  3. ^ Collin, Lasse. "Remove the backdoor found in 5.6.0 and 5.6.1 (CVE-2024-3094)". GitHub. Retrieved 19 June 2024.
  4. ^ James, Sam. "xz-utils backdoor situation (CVE-2024-3094)". GitHub. Archived from the original on 2 April 2024. Retrieved 2 April 2024.
  5. ^ Gatlan, Sergiu. "Red Hat warns of backdoor in XZ tools used by most Linux distros". BleepingComputer. Archived from the original on 29 March 2024. Retrieved 29 March 2024.
  6. ^ "CVE-2024-3094". National Vulnerability Database. NIST. Archived from the original on 2 April 2024. Retrieved 2 April 2024.
  7. ^ Corbet, Jonathan. "A backdoor in xz". LWN. Archived from the original on 1 April 2024. Retrieved 2 April 2024.


Cite error: There are <ref group=lower-alpha> tags or {{efn}} templates on this page, but the references will not show without a {{reflist|group=lower-alpha}} template or {{notelist}} template (see the help page).

Rich TVX News Network Site

Rich TVX News Network Info

© MMXXIII Rich X Search. We shall prevail. All rights reserved. Rich X Search