mrbuglf/xz-utils_cve-2024-3094XZ-Utils工具库恶意后门植入漏洞(CVE-2024-3094)
XZ is a data compression format present in almost every Linux distribution. liblzma is an open-source software library that handles XZ compression format. On March 29, developers discovered a supply chain attack on the XZ package, tracing it to a backdoor trojan implanted in the upstream liblzma library of SSH. When certain conditions are met, it decrypts C2 commands in the traffic for execution.
| OS | Package name | Package version(s) | Fix package version | Reference |
|---|---|---|---|---|
| Fedora 40, Rawhide | xz | 5.6.0, 5.6.1 | Revert to 5.4.x | Details |
| Debian unstable (Sid) | xz-utils | 5.6.1 | Revert to 5.4.5 | Details |
| Alpine edge | xz | 5.6.1-r2 | Revert to 5.4.x | Details |
| Arch Linux | xz | 5.6.0-1, 5.6.1-1 | Upgrade to 5.6.1-2 | Details |
| openSUSE Tumbleweed openSUSE MicroOS | xz | 5.6.0 | Revert to 5.4.x | Details |
Currently, there is no latest version available. The XZ version needs to be downgraded to 5.4.x.
