xz-backdoor-github

xz-backdoor-github 2024年3月29日发现的xz后门相关提交历史：CVE-2024-3094。 目前GitHub已因违反服务条款（ToS）而下架了相关仓库。本项目的目的是促进安全研究，了解这个后门是如何在持续两年的活跃贡献过程中被悄悄植入的，并查找其他潜在问题。 背景资料请参见：https://www.openwall.com/lists/oss-security/2024/03/29/4 数据集...

Malicious Code in XZ Utils for Linux Systems Enables Remote Code Execution

The malicious code inserted into the open-source library XZ Utils, a widely used package present in major Linux distributions, is also capable of facilitating remote code execution, a new analysis has revealed. The audacious supply chain compromise, tracked as CVE-2024-3094 CVSS score: 10.0, came...

Tukaani Project XZ Utils Backdoor (Feb/Mar 2024)

The XZ Utils of the Tukaani Project have been backdoored by an unknown threat actor in February and March 2024. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Urgent: Secret Backdoor Found in XZ Utils Library, Impacts Major Linux Distros

Red Hat on Friday released an "urgent security alert" warning that two versions of a popular data compression library called XZ Utils previously LZMA Utils have been backdoored with malicious code designed to allow unauthorized remote access. The software supply chain compromise, tracked as...