Red Hat, Inc. https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz [No types assigned]

Red Hat, Inc. https://ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-problem/ [No types assigned]

Red Hat, Inc. https://research.swtch.com/xz-script [No types assigned]

Red Hat, Inc. https://research.swtch.com/xz-timeline [No types assigned]

Red Hat, Inc. https://www.kali.org/blog/about-the-xz-backdoor/ [No types assigned]

Red Hat, Inc. https://security.netapp.com/advisory/ntap-20240402-0001/ [No types assigned]

Red Hat, Inc. https://github.com/amlweems/xzbot [No types assigned]

Red Hat, Inc. https://news.ycombinator.com/item?id=39895344 [No types assigned]

Red Hat, Inc. https://www.vicarius.io/vsociety/vulnerabilities/cve-2024-3094 [No types assigned]

OR
     *cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*
     *cpe:2.3:a:tukaani:xz:5.6.1:*:*:*:*:*:*:*

NIST AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

https://access.redhat.com/security/cve/CVE-2024-3094 No Types Assigned

https://access.redhat.com/security/cve/CVE-2024-3094 Vendor Advisory

https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/ No Types Assigned

https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/ Third Party Advisory

https://aws.amazon.com/security/security-bulletins/AWS-2024-002/ No Types Assigned

https://aws.amazon.com/security/security-bulletins/AWS-2024-002/ Third Party Advisory

https://boehs.org/node/everything-i-know-about-the-xz-backdoor No Types Assigned

https://boehs.org/node/everything-i-know-about-the-xz-backdoor Third Party Advisory

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024 No Types Assigned

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024 Mailing List, Vendor Advisory

https://bugs.gentoo.org/928134 No Types Assigned

https://bugs.gentoo.org/928134 Issue Tracking, Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2272210 No Types Assigned

https://bugzilla.redhat.com/show_bug.cgi?id=2272210 Issue Tracking, Vendor Advisory

https://bugzilla.suse.com/show_bug.cgi?id=1222124 No Types Assigned

https://bugzilla.suse.com/show_bug.cgi?id=1222124 Issue Tracking, Third Party Advisory

https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405 No Types Assigned

https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405 Third Party Advisory

https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 No Types Assigned

https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 Third Party Advisory

https://github.com/advisories/GHSA-rxwq-x6h5-x525 No Types Assigned

https://github.com/advisories/GHSA-rxwq-x6h5-x525 Third Party Advisory

https://github.com/karcherm/xz-malware No Types Assigned

https://github.com/karcherm/xz-malware Third Party Advisory

https://gynvael.coldwind.pl/?lang=en&id=782 No Types Assigned

https://gynvael.coldwind.pl/?lang=en&id=782 Technical Description, Third Party Advisory

https://lists.debian.org/debian-security-announce/2024/msg00057.html No Types Assigned

https://lists.debian.org/debian-security-announce/2024/msg00057.html Mailing List, Third Party Advisory

https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html No Types Assigned

https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html Third Party Advisory

https://lwn.net/Articles/967180/ No Types Assigned

https://lwn.net/Articles/967180/ Issue Tracking, Third Party Advisory

https://news.ycombinator.com/item?id=39865810 No Types Assigned

https://news.ycombinator.com/item?id=39865810 Issue Tracking, Third Party Advisory

https://news.ycombinator.com/item?id=39877267 No Types Assigned

https://news.ycombinator.com/item?id=39877267 Issue Tracking

https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/ No Types Assigned

https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/ Third Party Advisory

https://security-tracker.debian.org/tracker/CVE-2024-3094 No Types Assigned

https://security-tracker.debian.org/tracker/CVE-2024-3094 Third Party Advisory

https://security.alpinelinux.org/vuln/CVE-2024-3094 No Types Assigned

https://security.alpinelinux.org/vuln/CVE-2024-3094 Third Party Advisory

https://security.archlinux.org/CVE-2024-3094 No Types Assigned

https://security.archlinux.org/CVE-2024-3094 Third Party Advisory

https://tukaani.org/xz-backdoor/ No Types Assigned

https://tukaani.org/xz-backdoor/ Issue Tracking, Vendor Advisory

https://twitter.com/LetsDefendIO/status/1774804387417751958 No Types Assigned

https://twitter.com/LetsDefendIO/status/1774804387417751958 Third Party Advisory

https://twitter.com/debian/status/1774219194638409898 No Types Assigned

https://twitter.com/debian/status/1774219194638409898 Press/Media Coverage

https://twitter.com/infosecb/status/1774595540233167206 No Types Assigned

https://twitter.com/infosecb/status/1774595540233167206 Press/Media Coverage

https://twitter.com/infosecb/status/1774597228864139400 No Types Assigned

https://twitter.com/infosecb/status/1774597228864139400 Press/Media Coverage

https://ubuntu.com/security/CVE-2024-3094 No Types Assigned

https://ubuntu.com/security/CVE-2024-3094 Third Party Advisory

https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094 No Types Assigned

https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094 Third Party Advisory, US Government Resource

https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils No Types Assigned

https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils Third Party Advisory

https://www.openwall.com/lists/oss-security/2024/03/29/4 No Types Assigned

https://www.openwall.com/lists/oss-security/2024/03/29/4 Mailing List

https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users No Types Assigned

https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users Vendor Advisory

https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils No Types Assigned

https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils Third Party Advisory

https://www.theregister.com/2024/03/29/malicious_backdoor_xz/ No Types Assigned

https://www.theregister.com/2024/03/29/malicious_backdoor_xz/ Press/Media Coverage

https://xeiaso.net/notes/2024/xz-vuln/ No Types Assigned

https://xeiaso.net/notes/2024/xz-vuln/ Third Party Advisory

Red Hat, Inc. https://twitter.com/LetsDefendIO/status/1774804387417751958 [No types assigned]

Red Hat, Inc. https://boehs.org/node/everything-i-know-about-the-xz-backdoor [No types assigned]

Red Hat, Inc. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024 [No types assigned]

Red Hat, Inc. https://bugs.gentoo.org/928134 [No types assigned]

Red Hat, Inc. https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405 [No types assigned]

Red Hat, Inc. https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 [No types assigned]

Red Hat, Inc. https://github.com/advisories/GHSA-rxwq-x6h5-x525 [No types assigned]

Red Hat, Inc. https://github.com/karcherm/xz-malware [No types assigned]

Red Hat, Inc. https://lists.debian.org/debian-security-announce/2024/msg00057.html [No types assigned]

Red Hat, Inc. https://lwn.net/Articles/967180/ [No types assigned]

Red Hat, Inc. https://tukaani.org/xz-backdoor/ [No types assigned]

Red Hat, Inc. https://twitter.com/debian/status/1774219194638409898 [No types assigned]

Red Hat, Inc. https://twitter.com/infosecb/status/1774595540233167206 [No types assigned]

Red Hat, Inc. https://twitter.com/infosecb/status/1774597228864139400 [No types assigned]

Red Hat, Inc. https://ubuntu.com/security/CVE-2024-3094 [No types assigned]

Red Hat, Inc. https://xeiaso.net/notes/2024/xz-vuln/ [No types assigned]

Red Hat, Inc. https://gynvael.coldwind.pl/?lang=en&id=782 [No types assigned]

Red Hat, Inc. https://news.ycombinator.com/item?id=39877267 [No types assigned]

Red Hat, Inc. https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html [No types assigned]

Red Hat, Inc. https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/ [No types assigned]

Red Hat, Inc. https://aws.amazon.com/security/security-bulletins/AWS-2024-002/ [No types assigned]

Red Hat, Inc. https://bugzilla.suse.com/show_bug.cgi?id=1222124 [No types assigned]

Red Hat, Inc. https://news.ycombinator.com/item?id=39865810 [No types assigned]

Red Hat, Inc. https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/ [No types assigned]

Red Hat, Inc. https://security-tracker.debian.org/tracker/CVE-2024-3094 [No types assigned]

Red Hat, Inc. https://security.alpinelinux.org/vuln/CVE-2024-3094 [No types assigned]

Red Hat, Inc. https://security.archlinux.org/CVE-2024-3094 [No types assigned]

Red Hat, Inc. https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094 [No types assigned]

Red Hat, Inc. https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils [No types assigned]

Red Hat, Inc. https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils [No types assigned]

Red Hat, Inc. https://www.theregister.com/2024/03/29/malicious_backdoor_xz/ [No types assigned]

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. The tarballs included extra .m4 files, which contained instructions for building with automake that did not exist in the repository. These instructions, through a series of complex obfuscations, extract a prebuilt object file from one of the test archives, which is then used to modify specific functions in the code while building the liblzma package. This issue results in liblzma being used by additional s

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. 
Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Red Hat, Inc. AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Red Hat, Inc. CWE-506

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. The tarballs included extra .m4 files, which contained instructions for building with automake that did not exist in the repository. These instructions, through a series of complex obfuscations, extract a prebuilt object file from one of the test archives, which is then used to modify specific functions in the code while building the liblzma package. This issue results in liblzma being used by additional s

Red Hat, Inc. https://access.redhat.com/security/cve/CVE-2024-3094 [No types assigned]

Red Hat, Inc. https://bugzilla.redhat.com/show_bug.cgi?id=2272210 [No types assigned]

Red Hat, Inc. https://www.openwall.com/lists/oss-security/2024/03/29/4 [No types assigned]

Red Hat, Inc. https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users [No types assigned]