Malicious code aimed at gaining unauthorized remote access via SSH (backdoor) and executing commands (CVE-2024-3094) was found in xz/liblzma. The malware was injected in versions 5.6.0 and 5.6.1 and has reportedly made its way into builds and repositories of Gentoo, Arch Linux, Debian sid/unstable, Fedora Rawhide/40-beta, openSUSE factory/tumbleweed, LibreELEC, Alpine edge, Solus, CRUX, Cygwin, MSYS2 mingw, HP-UX, Homebrew, KaOS, NixOS unstable, OpenIndiana, Parabola, PCLinuxOS, OpenMandriva cooker and rolling, pkgsrc current, Slackware current, Manjaro, and Void Linux. However, the backdoor may not be activated everywhere. The situation is exacerbated by the fact that the developer under suspicion has been involved in related community projects in recent years. Therefore, there are no grounds to trust the xz source code until all details and implications of the incident are clarified. Specifically, the relevant repository on GitHub has already been locked with the message: "Access to this repository has been restricted by GitHub staff due to violations of GitHub's terms of service."
Source: 3dnews.ru
