Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 30 Mar 2024 17:24:59 +0100
From: Solar Designer <>
Subject: Re: backdoor in upstream xz/liblzma leading to ssh server compromise

On Sat, Mar 30, 2024 at 11:32:54AM -0400, Jeffrey Walton wrote:
> Lasse published a statement at <>.

Quoting here for archival, and ease and safety of access:

XZ Utils backdoor
Lasse Collin

This page is short for now but it will get updated as I learn more about the incident. Most likely it will be during the first week of April 2024.

The Git repositories of XZ projects are on DNS name (CNAME) has been removed. The XZ projects currently don't have a home page. This will be fixed in a few days.


- CVE-2024-3094

- XZ Utils 5.6.0 and 5.6.1 release tarballs contain a backdoor. These tarballs were created and signed by Jia Tan.

- Tarballs created by Jia Tan were signed by him. Any tarballs signed by me were created by me.

- GitHub accounts of both me (Larhzu) and Jia Tan are suspended.

- (DNS CNAME) was hosted on GitHub pages and thus is down too. It might be moved to back to the main domain in the near future.

- Only I have had access to the main website, repositories, and related files. Jia Tan only had access to things hosted on GitHub, including subdomain (and only that subdomain).


- Details by Andres Freund

- FAQ by thesamesam

- Gentoo bug 928134

- Debian bug 1068024


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.