CVE-2024-3094
Fixed in a distro release EPSS 91%CVSS 10.0
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat JBoss Enterprise Application Platform 8
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.15 | lighttpd | 1.4.76-r0 |
| Alpine 3.16 | lighttpd | 1.4.76-r0 |
| Alpine 3.17 | lighttpd | 1.4.76-r0 |
| Alpine 3.18 | lighttpd | 1.4.76-r0 |
| Alpine 3.20 | xz | 5.6.1-r2 |
| Alpine 3.21 | xz | 5.6.1-r2 |
| Alpine 3.22 | xz | 5.6.1-r2 |
| Alpine 3.23 | xz | 5.6.1-r2 |
| Alpine 3.24 | xz | 5.6.1-r2 |
| Arch Linux | xz | 5.6.1-2 |
| Chainguard | openssh | 0 |
| Chainguard | openssh-client | 0 |
| Chainguard | openssh-doc | 0 |
| Chainguard | openssh-keygen | 0 |
| Chainguard | openssh-keyscan | 0 |
| Chainguard | openssh-keysign | 0 |
| Chainguard | openssh-pam-config | 0 |
| Chainguard | openssh-pam-configuration | 0 |
| Chainguard | openssh-pkcs11-helper | 0 |
| Chainguard | openssh-server | 0 |
| Chainguard | openssh-server-config | 0 |
| Chainguard | openssh-service | 0 |
| Chainguard | openssh-sftp-server | 0 |
| Chainguard | openssh-sk-helper | 0 |
| Chainguard | xz | 0 |
| Chainguard | xz-dev | 0 |
| Chainguard | xz-doc | 0 |
| Debian 13 | xz-utils | 5.6.1+really5.4.5-1 |
| Debian 14 | xz-utils | 5.6.1+really5.4.5-1 |
| Ubuntu 20.04 LTS | xz-utils | 5.2.4-1ubuntu1.1 |
| Ubuntu 22.04 LTS | xz-utils | 5.2.5-2ubuntu1 |
| Ubuntu 24.04 LTS | xz-utils | 5.4.5-0.3 |
| Wolfi | openssh | 0 |
| Wolfi | openssh-client | 0 |
| Wolfi | openssh-doc | 0 |
| Wolfi | openssh-keygen | 0 |
| Wolfi | openssh-keyscan | 0 |
| Wolfi | openssh-keysign | 0 |
| Wolfi | openssh-pam-config | 0 |
| Wolfi | openssh-pam-configuration | 0 |
| Wolfi | openssh-pkcs11-helper | 0 |
| Wolfi | openssh-server | 0 |
| Wolfi | openssh-server-config | 0 |
| Wolfi | openssh-service | 0 |
| Wolfi | openssh-sftp-server | 0 |
| Wolfi | openssh-sk-helper | 0 |
| Wolfi | xz | 0 |
| Wolfi | xz-dev | 0 |
| Wolfi | xz-doc | 0 |
| openSUSE Tumbleweed | xz | 5.6.2-1.1 |