Are You Affected by the Backdoor in XZ Utils?

Pink Hat is warning {that a} vulnerability in XZ Utils, the XZ format compression utility included in lots of Linux distributions is a backdoor. Customers ought to both downgrade the utility to a safer model or disable ssh completely in order that the backdoor can’t be exploited.

The code injection vulnerability (CVE-2024-3094), injects code into the authentication course of that permits malicious actor to realize distant entry to the system. Red Hat stated in its advisory to “PLEASE IMMEDIATELY STOP USAGE OF ANY FEDORA RAWHIDE INSTANCES for work or private exercise” — emphasis theirs — till the corporate reverted its xz model to five.4.x and gave the all-clear. The flaw has been assigned a CVSS (Frequent Vulnerability Scoring System) rating of 10.0.

The flaw is current in xz versions 5.6.0 (launched Feb. 24) and 5.6.1 (launched March 9). The US Cybersecurity and Infrastructure Safety Company (CISA) advised developers and users to downgrade XZ Utils to an earlier, uncompromised model, comparable to XZ Utils 5.4.6 Stable.

Here is methods to inform if the system is working the affected model:

xz –version

If the output says xz (XZ UTils) 5.6.1 or liblzma 5.6.1, then customers ought to both apply the replace for his or her distribution (if accessible), downgrade xz, or disable ssh in the intervening time.

Whereas the problem primarily impacts Linux distributions, there are experiences that some variations of MacOS could also be working the compromised packages. If that’s the case, working brew improve on the Mac ought to downgrade xz from 5.6.0 to five.4.6.

Which Linux Distros Are Affected?

Whereas critical, the influence could also be restricted. The problematic code is within the newer variations of xz/liblzma, so it is probably not as extensively deployed. Linux distributions that haven’t but launched the newer variations are much less prone to be affected.

Pink Hat: Susceptible packages are current in Fedora 41 and Fedora Rawhide. No variations of Pink Hat Enterprise Linux (RHEL) are affected. Pink Hat says customers ought to instantly cease utilizing the affected variations till the corporate has had an opportunity to alter the xz model.

SUSE: An update is available for openSUSE (Tumbleweed or MicroOS).

Debian Linux: No steady variations of the distribution are affected, however compromised packages had been a part of the testing, unstable, and experimental variations. Customers ought to update xz-utils.

Kali Linux: If programs had been up to date between March 26 and March 29, then customers ought to update again to get the fix. If Kali’s final replace was earlier than the twenty sixth, it’s not affected by this backdoor.

This listing will probably be up to date as different distributions present data.