Xz: malicious code in distributed source
Summary
Xz: malicious code in distributed source
Original description
The description as published by the source.
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.
Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2024-3094 lighttpd Fixed in: 1.4.76-r0
- Debian DEBIAN-CVE-2024-3094 xz-utils Fixed in: 5.6.1+really5.4.5-1
References
- advisory access.redhat.com
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- package github.com
- package github.com
- package github.com
- report bugzilla.redhat.com
- report bugzilla.suse.com
- web openwall.com
- web openwall.com
- web openwall.com
- web openwall.com
- web openwall.com
- web openwall.com
- web openwall.com
- web openwall.com
- web openwall.com
- web openwall.com
- web access.redhat.com
- web access.redhat.com
- web ariadne.space
- web arstechnica.com
- web aws.amazon.com
- web boehs.org
- web bugs.debian.org
- web bugs.gentoo.org
- web discourse.nixos.org
- web gist.github.com
- web gynvael.coldwind.pl
- web lists.debian.org
- web lists.freebsd.org
- web lwn.net
- web news.ycombinator.com
- web news.ycombinator.com
- web news.ycombinator.com
- web research.swtch.com
- web research.swtch.com
- web security-tracker.debian.org
- web security.alpinelinux.org
- web security.archlinux.org
- web tukaani.org
- web twitter.com
- web twitter.com
- web twitter.com
- web twitter.com
- web ubuntu.com
- web cisa.gov
- web darkreading.com
- web openwall.com
- web theregister.com
- web vicarius.io
- web xeiaso.net
- web blog.netbsd.org
- web openssf.org
- web binarly.io
- web kali.org
- web redhat.com
- web tenable.com