http://www.openwall.com/lists/oss-security/2024/03/29/10

http://www.openwall.com/lists/oss-security/2024/03/29/12

http://www.openwall.com/lists/oss-security/2024/03/29/4

http://www.openwall.com/lists/oss-security/2024/03/29/5

http://www.openwall.com/lists/oss-security/2024/03/29/8

http://www.openwall.com/lists/oss-security/2024/03/30/12

http://www.openwall.com/lists/oss-security/2024/03/30/27

http://www.openwall.com/lists/oss-security/2024/03/30/36

http://www.openwall.com/lists/oss-security/2024/03/30/5

http://www.openwall.com/lists/oss-security/2024/04/16/5

https://ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-problem/

https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/

https://aws.amazon.com/security/security-bulletins/AWS-2024-002/

https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz

https://boehs.org/node/everything-i-know-about-the-xz-backdoor

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024

https://bugs.gentoo.org/928134

https://bugzilla.suse.com/show_bug.cgi?id=1222124

https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405

https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27

https://github.com/advisories/GHSA-rxwq-x6h5-x525

https://github.com/amlweems/xzbot

https://github.com/karcherm/xz-malware

https://gynvael.coldwind.pl/?lang=en&id=782

https://lists.debian.org/debian-security-announce/2024/msg00057.html

https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html

https://lwn.net/Articles/967180/

https://news.ycombinator.com/item?id=39865810

https://news.ycombinator.com/item?id=39877267

https://news.ycombinator.com/item?id=39895344

https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/

https://research.swtch.com/xz-script

https://research.swtch.com/xz-timeline

https://security-tracker.debian.org/tracker/CVE-2024-3094

https://security.alpinelinux.org/vuln/CVE-2024-3094

https://security.archlinux.org/CVE-2024-3094

https://security.netapp.com/advisory/ntap-20240402-0001/

https://tukaani.org/xz-backdoor/

https://twitter.com/LetsDefendIO/status/1774804387417751958

https://twitter.com/debian/status/1774219194638409898

https://twitter.com/infosecb/status/1774595540233167206

https://twitter.com/infosecb/status/1774597228864139400

https://ubuntu.com/security/CVE-2024-3094

https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094

https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils

https://www.kali.org/blog/about-the-xz-backdoor/

https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils

https://www.theregister.com/2024/03/29/malicious_backdoor_xz/

https://www.vicarius.io/vsociety/vulnerabilities/cve-2024-3094

https://xeiaso.net/notes/2024/xz-vuln/

https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/ Types: Third Party Advisory

https://aws.amazon.com/security/security-bulletins/AWS-2024-002/ Types: Third Party Advisory

https://boehs.org/node/everything-i-know-about-the-xz-backdoor Types: Third Party Advisory

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024 Types: Mailing List, Vendor Advisory

https://bugs.gentoo.org/928134 Types: Issue Tracking, Third Party Advisory

https://bugzilla.suse.com/show_bug.cgi?id=1222124 Types: Issue Tracking, Third Party Advisory

https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405 Types: Third Party Advisory

https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 Types: Third Party Advisory

https://github.com/advisories/GHSA-rxwq-x6h5-x525 Types: Third Party Advisory

https://github.com/karcherm/xz-malware Types: Third Party Advisory

https://gynvael.coldwind.pl/?lang=en&id=782 Types: Technical Description, Third Party Advisory

https://lists.debian.org/debian-security-announce/2024/msg00057.html Types: Mailing List, Third Party Advisory

https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html Types: Third Party Advisory

https://lwn.net/Articles/967180/ Types: Issue Tracking, Third Party Advisory

https://news.ycombinator.com/item?id=39865810 Types: Issue Tracking, Third Party Advisory

https://news.ycombinator.com/item?id=39877267 Types: Issue Tracking

https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/ Types: Third Party Advisory

https://security-tracker.debian.org/tracker/CVE-2024-3094 Types: Third Party Advisory

https://security.alpinelinux.org/vuln/CVE-2024-3094 Types: Third Party Advisory

https://security.archlinux.org/CVE-2024-3094 Types: Third Party Advisory

https://tukaani.org/xz-backdoor/ Types: Issue Tracking, Vendor Advisory

https://twitter.com/LetsDefendIO/status/1774804387417751958 Types: Third Party Advisory

https://twitter.com/debian/status/1774219194638409898 Types: Press/Media Coverage

https://twitter.com/infosecb/status/1774595540233167206 Types: Press/Media Coverage

https://twitter.com/infosecb/status/1774597228864139400 Types: Press/Media Coverage

https://ubuntu.com/security/CVE-2024-3094 Types: Third Party Advisory

https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094 Types: Third Party Advisory, US Government Resource

https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils Types: Third Party Advisory

https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils Types: Third Party Advisory

https://www.theregister.com/2024/03/29/malicious_backdoor_xz/ Types: Press/Media Coverage

https://xeiaso.net/notes/2024/xz-vuln/ Types: Third Party Advisory

http://www.openwall.com/lists/oss-security/2024/03/29/10

http://www.openwall.com/lists/oss-security/2024/03/29/12

http://www.openwall.com/lists/oss-security/2024/03/29/4

http://www.openwall.com/lists/oss-security/2024/03/29/5

http://www.openwall.com/lists/oss-security/2024/03/29/8

http://www.openwall.com/lists/oss-security/2024/03/30/12

http://www.openwall.com/lists/oss-security/2024/03/30/27

http://www.openwall.com/lists/oss-security/2024/03/30/36

http://www.openwall.com/lists/oss-security/2024/03/30/5

http://www.openwall.com/lists/oss-security/2024/04/16/5

https://access.redhat.com/security/cve/CVE-2024-3094

https://ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-problem/

https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/

https://aws.amazon.com/security/security-bulletins/AWS-2024-002/

https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz

https://boehs.org/node/everything-i-know-about-the-xz-backdoor

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024

https://bugs.gentoo.org/928134

https://bugzilla.redhat.com/show_bug.cgi?id=2272210

https://bugzilla.suse.com/show_bug.cgi?id=1222124

https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405

https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27

https://github.com/advisories/GHSA-rxwq-x6h5-x525

https://github.com/amlweems/xzbot

https://github.com/karcherm/xz-malware

https://gynvael.coldwind.pl/?lang=en&id=782

https://lists.debian.org/debian-security-announce/2024/msg00057.html

https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html

https://lwn.net/Articles/967180/

https://news.ycombinator.com/item?id=39865810

https://news.ycombinator.com/item?id=39877267

https://news.ycombinator.com/item?id=39895344

https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/

https://research.swtch.com/xz-script

https://research.swtch.com/xz-timeline

https://security-tracker.debian.org/tracker/CVE-2024-3094

https://security.alpinelinux.org/vuln/CVE-2024-3094

https://security.archlinux.org/CVE-2024-3094

https://security.netapp.com/advisory/ntap-20240402-0001/

https://tukaani.org/xz-backdoor/

https://twitter.com/LetsDefendIO/status/1774804387417751958

https://twitter.com/debian/status/1774219194638409898

https://twitter.com/infosecb/status/1774595540233167206

https://twitter.com/infosecb/status/1774597228864139400

https://ubuntu.com/security/CVE-2024-3094

https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094

https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils

https://www.kali.org/blog/about-the-xz-backdoor/

https://www.openwall.com/lists/oss-security/2024/03/29/4

https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users

https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils

https://www.theregister.com/2024/03/29/malicious_backdoor_xz/

https://www.vicarius.io/vsociety/vulnerabilities/cve-2024-3094

https://xeiaso.net/notes/2024/xz-vuln/

Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/03/29/12 [No types assigned]

Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/04/16/5 [No types assigned]

Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/03/29/10 [No types assigned]

Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/03/29/4 [No types assigned]

Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/03/29/5 [No types assigned]

Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/03/29/8 [No types assigned]

Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/03/30/27 [No types assigned]

Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/03/30/36 [No types assigned]

Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/03/30/5 [No types assigned]

Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/03/30/12 [No types assigned]

Red Hat, Inc. https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz [No types assigned]

Red Hat, Inc. https://ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-problem/ [No types assigned]

Red Hat, Inc. https://research.swtch.com/xz-script [No types assigned]

Red Hat, Inc. https://research.swtch.com/xz-timeline [No types assigned]

Red Hat, Inc. https://www.kali.org/blog/about-the-xz-backdoor/ [No types assigned]

Red Hat, Inc. https://security.netapp.com/advisory/ntap-20240402-0001/ [No types assigned]

Red Hat, Inc. https://github.com/amlweems/xzbot [No types assigned]

Red Hat, Inc. https://news.ycombinator.com/item?id=39895344 [No types assigned]

Red Hat, Inc. https://www.vicarius.io/vsociety/vulnerabilities/cve-2024-3094 [No types assigned]

NIST AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

OR
     *cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*
     *cpe:2.3:a:tukaani:xz:5.6.1:*:*:*:*:*:*:*

https://access.redhat.com/security/cve/CVE-2024-3094 No Types Assigned

https://access.redhat.com/security/cve/CVE-2024-3094 Vendor Advisory

https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/ No Types Assigned

https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/ Third Party Advisory

https://aws.amazon.com/security/security-bulletins/AWS-2024-002/ No Types Assigned

https://aws.amazon.com/security/security-bulletins/AWS-2024-002/ Third Party Advisory

https://boehs.org/node/everything-i-know-about-the-xz-backdoor No Types Assigned

https://boehs.org/node/everything-i-know-about-the-xz-backdoor Third Party Advisory

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024 No Types Assigned

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024 Mailing List, Vendor Advisory

https://bugs.gentoo.org/928134 No Types Assigned

https://bugs.gentoo.org/928134 Issue Tracking, Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2272210 No Types Assigned

https://bugzilla.redhat.com/show_bug.cgi?id=2272210 Issue Tracking, Vendor Advisory

https://bugzilla.suse.com/show_bug.cgi?id=1222124 No Types Assigned

https://bugzilla.suse.com/show_bug.cgi?id=1222124 Issue Tracking, Third Party Advisory

https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405 No Types Assigned

https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405 Third Party Advisory

https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 No Types Assigned

https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 Third Party Advisory

https://github.com/advisories/GHSA-rxwq-x6h5-x525 No Types Assigned

https://github.com/advisories/GHSA-rxwq-x6h5-x525 Third Party Advisory

https://github.com/karcherm/xz-malware No Types Assigned

https://github.com/karcherm/xz-malware Third Party Advisory

https://gynvael.coldwind.pl/?lang=en&id=782 No Types Assigned

https://gynvael.coldwind.pl/?lang=en&id=782 Technical Description, Third Party Advisory

https://lists.debian.org/debian-security-announce/2024/msg00057.html No Types Assigned

https://lists.debian.org/debian-security-announce/2024/msg00057.html Mailing List, Third Party Advisory

https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html No Types Assigned

https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html Third Party Advisory

https://lwn.net/Articles/967180/ No Types Assigned

https://lwn.net/Articles/967180/ Issue Tracking, Third Party Advisory

https://news.ycombinator.com/item?id=39865810 No Types Assigned

https://news.ycombinator.com/item?id=39865810 Issue Tracking, Third Party Advisory

https://news.ycombinator.com/item?id=39877267 No Types Assigned

https://news.ycombinator.com/item?id=39877267 Issue Tracking

https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/ No Types Assigned

https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/ Third Party Advisory

https://security-tracker.debian.org/tracker/CVE-2024-3094 No Types Assigned

https://security-tracker.debian.org/tracker/CVE-2024-3094 Third Party Advisory

https://security.alpinelinux.org/vuln/CVE-2024-3094 No Types Assigned

https://security.alpinelinux.org/vuln/CVE-2024-3094 Third Party Advisory

https://security.archlinux.org/CVE-2024-3094 No Types Assigned

https://security.archlinux.org/CVE-2024-3094 Third Party Advisory

https://tukaani.org/xz-backdoor/ No Types Assigned

https://tukaani.org/xz-backdoor/ Issue Tracking, Vendor Advisory

https://twitter.com/LetsDefendIO/status/1774804387417751958 No Types Assigned

https://twitter.com/LetsDefendIO/status/1774804387417751958 Third Party Advisory

https://twitter.com/debian/status/1774219194638409898 No Types Assigned

https://twitter.com/debian/status/1774219194638409898 Press/Media Coverage

https://twitter.com/infosecb/status/1774595540233167206 No Types Assigned

https://twitter.com/infosecb/status/1774595540233167206 Press/Media Coverage

https://twitter.com/infosecb/status/1774597228864139400 No Types Assigned

https://twitter.com/infosecb/status/1774597228864139400 Press/Media Coverage

https://ubuntu.com/security/CVE-2024-3094 No Types Assigned

https://ubuntu.com/security/CVE-2024-3094 Third Party Advisory

https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094 No Types Assigned

https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094 Third Party Advisory, US Government Resource

https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils No Types Assigned

https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils Third Party Advisory

https://www.openwall.com/lists/oss-security/2024/03/29/4 No Types Assigned

https://www.openwall.com/lists/oss-security/2024/03/29/4 Mailing List

https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users No Types Assigned

https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users Vendor Advisory

https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils No Types Assigned

https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils Third Party Advisory

https://www.theregister.com/2024/03/29/malicious_backdoor_xz/ No Types Assigned

https://www.theregister.com/2024/03/29/malicious_backdoor_xz/ Press/Media Coverage

https://xeiaso.net/notes/2024/xz-vuln/ No Types Assigned

https://xeiaso.net/notes/2024/xz-vuln/ Third Party Advisory

Red Hat, Inc. https://twitter.com/LetsDefendIO/status/1774804387417751958 [No types assigned]

Red Hat, Inc. https://boehs.org/node/everything-i-know-about-the-xz-backdoor [No types assigned]

Red Hat, Inc. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024 [No types assigned]

Red Hat, Inc. https://bugs.gentoo.org/928134 [No types assigned]

Red Hat, Inc. https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405 [No types assigned]

Red Hat, Inc. https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 [No types assigned]

Red Hat, Inc. https://github.com/advisories/GHSA-rxwq-x6h5-x525 [No types assigned]

Red Hat, Inc. https://github.com/karcherm/xz-malware [No types assigned]

Red Hat, Inc. https://lists.debian.org/debian-security-announce/2024/msg00057.html [No types assigned]

Red Hat, Inc. https://lwn.net/Articles/967180/ [No types assigned]

Red Hat, Inc. https://tukaani.org/xz-backdoor/ [No types assigned]

Red Hat, Inc. https://twitter.com/debian/status/1774219194638409898 [No types assigned]

Red Hat, Inc. https://twitter.com/infosecb/status/1774595540233167206 [No types assigned]

Red Hat, Inc. https://twitter.com/infosecb/status/1774597228864139400 [No types assigned]

Red Hat, Inc. https://ubuntu.com/security/CVE-2024-3094 [No types assigned]

Red Hat, Inc. https://xeiaso.net/notes/2024/xz-vuln/ [No types assigned]

Red Hat, Inc. https://gynvael.coldwind.pl/?lang=en&id=782 [No types assigned]

Red Hat, Inc. https://news.ycombinator.com/item?id=39877267 [No types assigned]

Red Hat, Inc. https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html [No types assigned]

Red Hat, Inc. https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/ [No types assigned]

Red Hat, Inc. https://aws.amazon.com/security/security-bulletins/AWS-2024-002/ [No types assigned]

Red Hat, Inc. https://bugzilla.suse.com/show_bug.cgi?id=1222124 [No types assigned]

Red Hat, Inc. https://news.ycombinator.com/item?id=39865810 [No types assigned]

Red Hat, Inc. https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/ [No types assigned]

Red Hat, Inc. https://security-tracker.debian.org/tracker/CVE-2024-3094 [No types assigned]

Red Hat, Inc. https://security.alpinelinux.org/vuln/CVE-2024-3094 [No types assigned]

Red Hat, Inc. https://security.archlinux.org/CVE-2024-3094 [No types assigned]

Red Hat, Inc. https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094 [No types assigned]

Red Hat, Inc. https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils [No types assigned]

Red Hat, Inc. https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils [No types assigned]

Red Hat, Inc. https://www.theregister.com/2024/03/29/malicious_backdoor_xz/ [No types assigned]

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. The tarballs included extra .m4 files, which contained instructions for building with automake that did not exist in the repository. These instructions, through a series of complex obfuscations, extract a prebuilt object file from one of the test archives, which is then used to modify specific functions in the code while building the liblzma package. This issue results in liblzma being used by additional s

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. 
Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. The tarballs included extra .m4 files, which contained instructions for building with automake that did not exist in the repository. These instructions, through a series of complex obfuscations, extract a prebuilt object file from one of the test archives, which is then used to modify specific functions in the code while building the liblzma package. This issue results in liblzma being used by additional s

Red Hat, Inc. AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Red Hat, Inc. CWE-506

Red Hat, Inc. https://access.redhat.com/security/cve/CVE-2024-3094 [No types assigned]

Red Hat, Inc. https://bugzilla.redhat.com/show_bug.cgi?id=2272210 [No types assigned]

Red Hat, Inc. https://www.openwall.com/lists/oss-security/2024/03/29/4 [No types assigned]

Red Hat, Inc. https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users [No types assigned]