sec_review_cve-2024-3094

A full security review of the open-source vulnerability CVE-2024-3094 was conducted. Based on the obtained data, the following were prepared:

1. Report «ThreatModel + SecurityReview» – detailed description of threats, exploitation paths, risk assessment, and recommendations for reducing the attack surface.
2. Verification test package – a set of automated tests confirming the presence/absence of the vulnerability after applying the patch.

The report is presented in the file Report_Final.pdf

Sources:

Archive with vulnerable version: https://github.com/thesamesam/xz-archive

Exploit for this CVE: https://github.com/amlweems/xzbot