Cyb3rius
@cyb3rius
· 2d
How was the XZ Utils backdoor almost missed?A Microsoft engineer accidentally caught it while benchmarking PostgreSQL — a half-second SSH delay was the only visible clue.What happened: On March 29, 2024, Andres Freund traced mysterious SSH slowness on his Debian testing machine to malicious code hidden inside xz/liblzma 5.6.0 and 5.6.1. A contributor using the name "Jia Tan" had spent roughly two years building trust in the project before inserting a backdoor that could let an attacker holding a specific private key bypass OpenSSH authentication on systemd-based systems. Fedora 40/41 and openSUSE Tumbleweed shipped the tainted versions before anyone noticed.Key numbers: CVE-2024-3094 carries a maximum CVSS score of 10.0The payload shipped in xz versions 5.6.0 and 5.6.1Roughly two years
0