In xz/liblzma is malicious code identified, aimed at obtaining unauthorized remote access via SSH (backdoor) and executing commands (CVE-2024-3094). The malware was introduced in versions 5.6.0 and 5.6.1 and, as reported by OpenNet, has made its way into builds and repositories of Gentoo, Arch Linux, Debian sid/unstable, Fedora Rawhide/40-beta, openSUSE factory/tumbleweed, LibreELEC, Alpine edge, Solus, CRUX, Cygwin, MSYS2 mingw, HP-UX, Homebrew, KaOS, NixOS unstable, OpenIndiana, Parabola, PCLinuxOS, OpenMandriva cooker and rolling, pkgsrc current, Slackware current, Manjaro, Void Linux. However, the backdoor may not be activated everywhere. The situation is exacerbated by the fact that the developer under suspicion has been involved in related community projects in recent years. Therefore, there is no reason to trust the xz source code until all details and consequences of the incident are clarified. In particular, the corresponding repository on GitHub has already been blocked with the message: “Access to this repository has been blocked by GitHub staff due to violation of GitHub's service terms.”
Bron: 3dnews.ru
