XZ Utils backdoor

Rare card · No. 39793

On 29 March 2024, a malicious backdoor was discovered in the compression software XZ Utils. The backdoor gives an attacker who possesses a specific private key the ability to remotely execute code on an affected system through OpenSSH, a set of networking utilities. The backdoor was discovered by software developer Andres Freund. It was later discovered that the exploit was deliberately included in the software in February 2024 by a user going by the name of "Jia Tan", affecting both versions 5.6.0 and 5.6.1. The issue was given the CVE number CVE-2024-3094 and was assigned a CVSS score of 10.0, the highest possible score, indicating that the exploit was extremely severe. While XZ Utils is present in most Linux distributions, at the time of discovery the affected versions had not yet been widely deployed to production systems, but were present in development versions of major distributions, resulting in distribution maintainers rebuilding their packages to mitigate the exploit. A patch...

Read on Wikipedia · Image Jia Tan, CC BY-SA 4.0