WGSA-2024-00007#
XZ Utils supply chain compromise (CVE-2024-3094)
Summary #
On March 29, a software engineer at Microsoft discovered and disclosed a supply chain attack against the popular Linux decompression utility XZ Utils. After analysis, researchers confirmed a rogue developer had inserted malicious code into the 5.6.0 and 5.6.1 releases of XZ Utils. This malicious code could allow an adversary with a carefully crafted SSH public key to execute arbitrary code with SYSTEM permissions on affected Linux-based systems.
No WatchGuard products use the affected versions of XZ Utils
CVE identifiers #
| CVE ID | Description | CVSS |
|---|---|---|
| CVE-2024-3094 | Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library. | 10.0 |
Product status #
| Product | Affected | Not affected |
|---|
Solution #
No solution has been published for this advisory.