Summary
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Debian Linux, SUSE Linux, Arch Linux, Fedora Linux, xz und Gentoo Linux ausnutzen, um beliebigen Programmcode auszuführen.
Product
XZ Utils bietet eine universelle Datenkompressionsbibliothek sowie Befehlszeilenwerkzeuge.
Vulnerabilities 1
-
Critical 10.0
Xz: malicious code in distributed source
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is the…
Revision history
-
#1
Initiale Fassung
References
-
Red Hat Security Alert vom 2024-04-01
https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
-
GitHub Advisory Database
https://github.com/advisories/GHSA-rxwq-x6h5-x525
-
Red Hat Bugzilla – Bug 2272210
https://bugzilla.redhat.com/show_bug.cgi?id=2272210
-
CISA Report
https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094
-
Statement des Autors von xz
https://tukaani.org/xz-backdoor/
-
Proof of Concept (PoC)
https://github.com/amlweems/xzbot