xz-utils Backdoor in liblzma 5.6.0/5.6.1 (CVE-2024-3094)
The backdoor only reached rolling and pre-release distributions for a few weeks before discovery; stable enterprise releases never shipped it, but any machine that ran xz 5.6.0 or 5.6.1 should be checked.
Must act: Anyone who ran Debian testing/unstable, Fedora 41/Rawhide or another rolling distribution with xz 5.6.0 or 5.6.1 in early 2024, or who still has those tarballs in a build pipeline or container image.
Can relax: Users of stable distributions such as RHEL and Debian stable, which never shipped 5.6.0 or 5.6.1, and anyone whose installed xz is not 5.6.0 or 5.6.1.
- Check the installed version with xz --version (and dpkg -l xz-utils liblzma5 or rpm -q xz xz-libs).
- If it reports 5.6.0 or 5.6.1, update to your distribution's fixed package (for Debian, 5.6.1+really5.4.5-1) or a clean upstream release.
- Search container images, build caches and vendored source trees for xz-5.6.0 or xz-5.6.1 tarballs and rebuild anything built from them.