PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2024-3094] Crying out Cloud: Our Favorite Stories of 2024

wiz.io | blog | CVE-2024-3094 | #ai-security | #cloud | #supply-chain | #cloud-security | #vulnerability | #research | #podcast
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

The Crying out Cloud team revisits 2024's top stories—the XZ Utils backdoor (CVE-2024-3094), the SeleniumGreed misconfiguration campaign, and the SAPwned flaws in SAP AI Core—and their lessons.
CVE
CVE-2024-3094
Published
Collected

Related coverage

blog · kali.org
xz-utils backdoor: how to get started
A beginner walkthrough for reproducing the xz-utils/liblzma backdoor (CVE-2024-3094): set up a Kali VM, install backdoored liblzma 5.6.1 from Debian snapshots, and verify the compromise.
vulnerability · wiz.io
Backdoor in XZ Utils allows RCE: everything you need to know
Wiz explains CVE-2024-3094, the XZ Utils backdoor in versions 5.6.0 and 5.6.1 that could enable SSH authentication bypass and RCE on certain distros; about 2% of cloud environments were affected.
vulnerability · hackerone.com
XZ Utils CVE-2024-3094: A Tale of Broken Trust, Curious Persistence, and a Call to Action
A backdoor in XZ Utils 5.6.0 and 5.6.1 (CVE-2024-3094) surfaced when Andres Freund noticed sshd slowdowns; the code hid in compressed test files after a long-grooming supply chain effort.
vulnerability · bugcrowd.com
Supply Chain Backdoors, xz/liblzma, CVE-2024-3094, and what we currently know
Summarizes the xz/liblzma CVE-2024-3094 supply chain backdoor: Microsoft's Andres Freund noticed odd SSH CPU usage and 500ms delays, uncovering a backdoor planted by long-term contributor Jia Tan.
vulnerability · kali.org
All about the xz-utils backdoor
Kali explains CVE-2024-3094: xz-utils 5.6.0-5.6.1 contained a backdoor that could compromise sshd authentication and grant remote system access, with commands to check and patch affected installs.
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
Back