PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Supply Chain Backdoors, xz/liblzma, CVE-2024-3094, and what we currently know

bugcrowd.com | vulnerability | CVE-2024-3094 | #supply-chain | #open-source | #backdoor | #xz-utils | #cve-2024-3094 | #ssh | #supply-chain-security | #liblzma
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Summarizes the xz/liblzma CVE-2024-3094 supply chain backdoor: Microsoft's Andres Freund noticed odd SSH CPU usage and 500ms delays, uncovering a backdoor planted by long-term contributor Jia Tan.
CVE
CVE-2024-3094
Published
Collected

Related coverage

vulnerability · wiz.io
Backdoor in XZ Utils allows RCE: everything you need to know
Wiz explains CVE-2024-3094, the XZ Utils backdoor in versions 5.6.0 and 5.6.1 that could enable SSH authentication bypass and RCE on certain distros; about 2% of cloud environments were affected.
vulnerability · hackerone.com
XZ Utils CVE-2024-3094: A Tale of Broken Trust, Curious Persistence, and a Call to Action
A backdoor in XZ Utils 5.6.0 and 5.6.1 (CVE-2024-3094) surfaced when Andres Freund noticed sshd slowdowns; the code hid in compressed test files after a long-grooming supply chain effort.
blog · kali.org
xz-utils backdoor: how to get started
A beginner walkthrough for reproducing the xz-utils/liblzma backdoor (CVE-2024-3094): set up a Kali VM, install backdoored liblzma 5.6.1 from Debian snapshots, and verify the compromise.
vulnerability · kali.org
All about the xz-utils backdoor
Kali explains CVE-2024-3094: xz-utils 5.6.0-5.6.1 contained a backdoor that could compromise sshd authentication and grant remote system access, with commands to check and patch affected installs.
blog · wiz.io
Crying out Cloud: Our Favorite Stories of 2024
The Crying out Cloud team revisits 2024's top stories—the XZ Utils backdoor (CVE-2024-3094), the SeleniumGreed misconfiguration campaign, and the SAPwned flaws in SAP AI Core—and their lessons.
research · certik.com
Skill Scanning Is Not a Security Boundary
This article argues that scanning third-party OpenClaw skills (e.g. Clawhub's VirusTotal and AI review pipeline) is not a security boundary, since skills execute with full privileged-runtime access.
Back