In March, we received notifications about the open-source project XZ Utils, which provides lossless data compression on all Unix-like operating systems.| www.binarly.io
On Friday, March 29, developer Andres Freund shared that he had discovered an upstream backdoor in widely used command line tool XZ Utils (liblzma).| Rapid7
Microsoft software engineer Andres Freund discovers a backdoor lurking in the XZ Utils data-compression tools, which are open source and widely used across Linux distributions.| PCMAG
Although there have been no major security findings in recent months, the SUSE security team has not been inactive. We revisited a couple of packages like Deepin desktop D-Bus services and the Croc file sharing tool, we finalized leftover KDE6 topics, checked up on our openSSH downstream patches, reviewed an age old Emacs setuid binary and looked into an OpenVPN kernel module.| SUSE Security Team Blog
Learn about a new, targeted backdoor supply chain attack against the popular XZ compression utility seen in many Linux distributions such as fedora and debian. Understand its impact, potential risks and what you can do about it.| www.sonatype.com
Frequently asked questions about CVE-2024-3094, a supply-chain attack responsible for a backdoor in XZ Utils, a widely used library found in multiple Linux distributions.| Tenable®
Nearly 90% of Threats Blocked are Social Engineering, Revealing a Huge Surge of Scams, and Discovery of the Lazarus APT Campaign| Avast Threat Labs
We are happy to announce the Beta release for Lubuntu Noble (what will become 24.04 LTS)!| Lubuntu
Kaspersky analysis of the backdoor recently found in XZ, which is used in many popular Linux distributions and in OpenSSH server process.| securelist.com
An impromptu special edition about CVE-2024-3094| www.detectionengineering.net
Easter Egg in xz, GSoC 2024, Opportunity Open Source 2024?, CPDB Snap, PAPPL scanning, Snap automation, SpliX 2.0.1| OpenPrinting
When I stumbled across a post that an encryption library offers a potential backdoor to SSH connectivity on Good Friday, my first thought was: why is it always on a Friday that these things drop? And then my second one: oh bugger, here goes my weekend. Now, I won’t go into the technical details, there are many, many, many, many better resources out there, but I can’t help thinking that this would/should force the software industry to think.| beny23.github.io
Update, April 3rd, 2024 The patches for CVE-2024-1086 are now available in production repos. For AlmaLinux 8, you are looking for kernel-4.18.0-513.18.2.el8_9 or higher. [root@host ~]# rpm -qa kernel kernel-4.18.0-513.18.2.el8_9.x86_64 [root@host ~]# For Almalinux 9, you are looking for kernel-5.14.0-362.24.2.el9_3 or higher [root@host ~]# rpm -qa kernel kernel-5.14.0-362.24.2.el9_3.x86_64 [root@host ~]# Thank you to everyone who tested these patches! ========= CVE-2024-1086 - call for testin...| AlmaLinux OS
«Die Feiertage. Die ganzen IT-Abteilungen feiern mit der Familie… Die ganzen IT-Abteilungen? Nein! Eine von unbeugsamen Open-Source-Enthusiasten bevölkerte| Das Netz ist politisch
It’s all over the tech news. Someone managed to put a backdoor on xz Utils, a very common package on Linux systems. In this post I want to share with you about what happened, how it impacted Kairos images, and what you should do in case you were affected. TL;DR A backdoor that can be used to exploit systemd based Linux via ssh was introduced in xz Utils. Only Kairos Tumbleweed v3.| kairos.io
The xz attack shell script| research.swtch.com
On March 29th, 2024, a backdoor in a popular package called XZ Utils was announced on the Openwall mailing list. This utility includes a library called| Sysdig
Some timezone observations on the recently discovered backdoor hidden in an xz tarball.| rheaeve.substack.com
Over the Easter weekend 2024, there was a big kerfuffle around a compression| bentsukun.ch
By Omkhar Arasaratnam, General Manager, OpenSSF; Bennett Pursell, Ecosystem Strategist, OpenSSF; Harry Toor, Chief of Staff, OpenSSF; Christopher “CRob” Robinson, OpenSSF TAC Chair & Director of Security Communications, Intel| openssf.org
Updated in 2024-04. GNU indirect function (ifunc) is a mechanism making a direct function call resolve to an implementation picked by a resolver. It is mainly used in glibc but has adoption in FreeBSD| MaskRay
