CVE-2024-3094

01/תיאור (מקור, אנגלית)

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

02/מוצרים מושפעים

tukaani: xz

03/קישורים10

• access.redhat.com/security/cve/CVE-2024-3094 Vendor Advisory
• bugzilla.redhat.com/show_bug.cgi?id=2272210 Issue TrackingVendor Advisory
• www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-raw‮… Vendor Advisory
• access.redhat.com/security/cve/CVE-2024-3094 Vendor Advisory
• bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024 Mailing ListVendor Advisory
• bugzilla.redhat.com/show_bug.cgi?id=2272210 Issue TrackingVendor Advisory
• tukaani.org/xz-backdoor/ Issue TrackingVendor Advisory
• www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-raw‮… Vendor Advisory
• www.openwall.com/lists/oss-security/2024/03/29/4 Mailing List
• www.openwall.com/lists/oss-security/2024/03/29/10