xz-utils · CVSS 10.0 · published 29 March 2024
xz backdoor: CVE-2024-3094
A backdoor hidden in the release tarballs of xz-utils 5.6.0 and 5.6.1 that could let its author log in through OpenSSH on some distributions. Distributions past end of life never shipped those versions. Below is its status on each Linux distribution past end of life, from the vendors' own security trackers.
- 0end-of-life systems without a free fix
- 9fixed or not affected
xz backdoor on end-of-life Linux
| Distribution | Status | Details |
|---|---|---|
| CentOS 6 | Not affected | Red Hat security data |
| CentOS 7 | Not affected | Red Hat security data |
| RHEL 7 | Not affected | Red Hat security data |
| CentOS 8 | Not affected | Red Hat security data |
| Ubuntu 16.04 | Not affected | Ubuntu security tracker |
| Ubuntu 18.04 | Not affected | Ubuntu security tracker |
| Ubuntu 20.04 | Not affected | Ubuntu security tracker |
| Debian 10 | Not affected | Debian security tracker |
| Debian 11 | Not affected | Debian security tracker |
From the Red Hat security data (CentOS and RHEL), the Ubuntu CVE tracker and the Debian security tracker, 29 October 2026. CentOS received Red Hat's fixes only until its own end of life; later fixes went to paid Red Hat support. Fixes marked Ubuntu Pro need a paid subscription. Where a tracker has no entry, the version in the distribution's repository is checked against the NVD range.
What the NVD record says
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
Score 10.0 (Critical), published 29 March 2024. Read the NVD entry
Affected upstream versions of xz-utils
- xz version 5.6.0
- xz version 5.6.1
What you can do
Keep xz-utils, patched
Where the table shows no free fix, we backport it to the package you run, built and tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to a supported release once your applications can make the jump. Our fixes keep you safe while you plan it.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.