Analysis · Retrospective 2024
The xz backdoor: why reviewing the repository was not enough
The 2024 disclosure put release archives, generated build files and distribution-specific build conditions inside the trust boundary.
CVE-2024-3094
Technical coverage, source documents and official vulnerability records.
FISRO coverage
Read the relevant deployment conditions, remediation steps and limits of the evidence in the linked material.
Sources from this coverage
- backdoor in upstream xz/liblzma leading to ssh server compromiseAndres Freund / oss-security
- Debian Security Tracker: CVE-2024-3094Debian Security Team
- Malicious code in xz 5.6.0 and 5.6.1 tarballs: NixOS assessmentNixOS security team