Today, Red Hat warned users to immediately stop using systems running Fedora development and experimental versions because of a backdoor found in the latest XZ Utils data compression tools and libraries. "PLEASE IMMEDIATELY STOP USAGE OF ANY FEDORA 41 OR FEDORA RAWHIDE INSTANCES for work or personal activity," Red Hat warned on Friday. "No versions of Red Hat Enterprise Linux (RHEL) are affected. We have reports and evidence of the injections successfully building in xz 5.6.x versions built for Debian unstable (Sid). Other distributions may also be affected." Debian's security team also issued an advisory warning users about the issue. The advisory says that no stable Debian versions are using the compromised packages and that XZ has been reverted to the upstream 5.4.5 code on affected Debian testing, unstable, and experimental distributions. Kali Linux, openSUSE, and Arch Linux have also published security advisories and reversed versions in affected rolling releases. Linux admins can check which version of XZ is installed by querying with their package manager or by running the following shell script shared by cybersecurity researcher Kostas. The above script will perform the 'strings' command on all instances of the xz executable and output its embedded version. Using this command allows you to determine the version without running the backdoored executable. If you are using versions 5.6.0 or 5.6.1, you are advised to immediately downgrade to older versions that do not co...
Red Hat warns of backdoor in XZ tools used by most Linux distros
BleepingComputer
·Sergiu Gatlan
·Published Mar 29, 2024
·Updated
Affected Software
3 affected components
Red Hat Fedora Development
Red Hat Fedora Rawhide
Debian Unstable
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses a security warning from Red Hat regarding a backdoor found in XZ tools affecting various Linux distributions.
2
What security implications are discussed?
The article highlights the significant risk posed by the backdoor, which compromises the security of systems using affected versions of XZ Utils.
3
What products or software are affected?
The affected software includes Fedora Development, Fedora Rawhide, and Debian Unstable versions.
4
What actions does Red Hat recommend for users?
Red Hat advises users to immediately stop using systems running the affected Fedora development and experimental versions.
5
Which libraries are specifically mentioned as compromised?
The compromised libraries are the latest XZ Utils data compression tools and libraries.