CVE-2024-3094

Name
CVE-2024-3094
Description
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
vdb-entry https://access.redhat.com/security/cve/CVE-2024-3094
issue-tracking https://bugzilla.redhat.com/show_bug.cgi?id=2272210
secalert@redhat.com https://www.openwall.com/lists/oss-security/2024/03/29/4
secalert@redhat.com https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
secalert@redhat.com https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/
secalert@redhat.com https://aws.amazon.com/security/security-bulletins/AWS-2024-002/
secalert@redhat.com https://bugzilla.suse.com/show_bug.cgi?id=1222124
secalert@redhat.com https://news.ycombinator.com/item?id=39865810
secalert@redhat.com https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/
secalert@redhat.com https://security-tracker.debian.org/tracker/CVE-2024-3094
secalert@redhat.com https://security.alpinelinux.org/vuln/CVE-2024-3094
secalert@redhat.com https://security.archlinux.org/CVE-2024-3094
secalert@redhat.com https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094
secalert@redhat.com https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils
secalert@redhat.com https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils
secalert@redhat.com https://www.theregister.com/2024/03/29/malicious_backdoor_xz/
secalert@redhat.com https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html
secalert@redhat.com https://gynvael.coldwind.pl/?lang=en&id=782
secalert@redhat.com https://news.ycombinator.com/item?id=39877267
secalert@redhat.com https://boehs.org/node/everything-i-know-about-the-xz-backdoor
secalert@redhat.com https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024
secalert@redhat.com https://bugs.gentoo.org/928134
secalert@redhat.com https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405
secalert@redhat.com https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27
secalert@redhat.com https://github.com/advisories/GHSA-rxwq-x6h5-x525
secalert@redhat.com https://github.com/karcherm/xz-malware
secalert@redhat.com https://lists.debian.org/debian-security-announce/2024/msg00057.html
secalert@redhat.com https://lwn.net/Articles/967180/
secalert@redhat.com https://tukaani.org/xz-backdoor/
secalert@redhat.com https://twitter.com/debian/status/1774219194638409898
secalert@redhat.com https://twitter.com/infosecb/status/1774595540233167206
secalert@redhat.com https://twitter.com/infosecb/status/1774597228864139400
secalert@redhat.com https://ubuntu.com/security/CVE-2024-3094
secalert@redhat.com https://xeiaso.net/notes/2024/xz-vuln/
Third Party Advisory https://twitter.com/LetsDefendIO/status/1774804387417751958
secalert@redhat.com https://github.com/amlweems/xzbot
secalert@redhat.com https://news.ycombinator.com/item?id=39895344
secalert@redhat.com https://www.vicarius.io/vsociety/vulnerabilities/cve-2024-3094
secalert@redhat.com https://security.netapp.com/advisory/ntap-20240402-0001/
secalert@redhat.com https://www.kali.org/blog/about-the-xz-backdoor/
secalert@redhat.com https://ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-problem/
secalert@redhat.com https://research.swtch.com/xz-script
secalert@redhat.com https://research.swtch.com/xz-timeline
secalert@redhat.com https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz
secalert@redhat.com http://www.openwall.com/lists/oss-security/2024/03/30/12
secalert@redhat.com http://www.openwall.com/lists/oss-security/2024/03/29/10
secalert@redhat.com http://www.openwall.com/lists/oss-security/2024/03/29/4
secalert@redhat.com http://www.openwall.com/lists/oss-security/2024/03/29/5
secalert@redhat.com http://www.openwall.com/lists/oss-security/2024/03/29/8
secalert@redhat.com http://www.openwall.com/lists/oss-security/2024/03/30/27
secalert@redhat.com http://www.openwall.com/lists/oss-security/2024/03/30/36
secalert@redhat.com http://www.openwall.com/lists/oss-security/2024/03/30/5
secalert@redhat.com http://www.openwall.com/lists/oss-security/2024/03/29/12
secalert@redhat.com http://www.openwall.com/lists/oss-security/2024/04/16/5

Match rules

CPE URI Source package Min version Max version
shopxo == 5.6.0 == 5.6.0
shopxo == 5.6.1 == 5.6.1

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
lighttpd 3.16-main 1.4.76-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
lighttpd 3.18-main 1.4.76-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
lighttpd 3.17-main 1.4.76-r0 Natanael Copa <ncopa@alpinelinux.org> fixed