---
id: 771
title: "Supply Chain Backdoors, xz/liblzma, CVE-2024-3094, and what we currently know"
cve: CVE-2024-3094
source_domain: bugcrowd.com
source_url: "https://www.bugcrowd.com/blog/supply-chain-backdoors-xz-liblzma-cve-2024-3094-and-what-we-currently-know/"
published_at: "2024-03-31T19:27:27Z"
tags: ["supply-chain", "open-source", "backdoor", "xz-utils", "cve-2024-3094", "ssh", "supply-chain-security", "liblzma"]
phying_url: "https://phying.com/item/771"
lang: en
---

# Supply Chain Backdoors, xz/liblzma, CVE-2024-3094, and what we currently know

## Summary

Summarizes the xz/liblzma CVE-2024-3094 supply chain backdoor: Microsoft's Andres Freund noticed odd SSH CPU usage and 500ms delays, uncovering a backdoor planted by long-term contributor Jia Tan.

## Intelligence Metadata

- **Sources:** bugcrowd.com
- **CVE:** CVE-2024-3094
- **Published:** 2024-03-31T19:27:27Z
- **Original:** https://www.bugcrowd.com/blog/supply-chain-backdoors-xz-liblzma-cve-2024-3094-and-what-we-currently-know/
- **Phying News:** https://phying.com/item/771