CVE-2024-3094 xz/liblzma Supply Chain Poisoning Vulnerability

Key Information Summary Vulnerability Overview CVE ID: CVE-2024-3094 Description: Malicious code was discovered in xz versions 5.6.0 and above. The code was embedded within pre-built object files disguised as test files, which were extracted during the liblzma build process. This allowed the modification of specific functions within liblzma, enabling any software linked to this library to intercept and modify data exchanged with the library. Severity and Tracking NVD Severity: Unknown Other Trackers: CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia Mailing Lists: oss-security, full-disclosure, bugtraq Exploit Databases: Exploit DB, Metasploit Repositories: GitHub (code, issues), Aports (code, issues) Affected Versions and Fix Status Affected Source Packages and Versions - xz - edge-main: 5.6.1-r3 (fixed), 5.6.1-r2 (fixed), 5.6.1-r2 (maintainer unspecified, fixed) - 3.22-main: 5.6.1-r2 (fixed) - 3.21-main: 5.6.1-r2 (maintainer unspecified, fixed), 5.6.1-r3 (fixed) - 3.20-main: 5.6.1-r2 (maintainer unspecified, fixed), 5.6.1-r3 (fixed) - lighttpd - 3.18-main: 1.4.76-r0 (fixed) - 3.17-main: 1.4.76-r0 (fixed) Reference Links A list of links to detailed descriptions, articles, security advisories, and other resources related to the vulnerability, facilitating further research and validation. This vulnerability involves a supply chain security issue affecting a widely used Linux utility library. The remediation efforts and impact assessment are critical.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-3094 xz/liblzma Supply Chain Poisoning Vulnerability