xz security alert and CVE-2024-3094
Ana Guerrero Lopez via openSUSE Factory [this message] ` Frank Krüger via openSUSE Factory ` Frank Krüger via openSUSE Factory ` Michal Suchánek ` Felix Miata ` Dirk Müller via openSUSE Factory ` Carlos E. R. ` yassadmi via openSUSE Factory ` Mihai Moldovan ` Dirk Müller via openSUSE Factory ` -pj via openSUSE Factory ` Frank Krüger via openSUSE Factory ` Matthias G. Eckermann via openSUSE Factory ` Andrei Borzenkov ` Ben Greiner ` Dirk Müller via openSUSE Factory ` Andrei Borzenkov ` Dirk Müller via openSUSE Factory ` Bernhard Voelker ` Dominique Leuenberger ` Joe Salmeri ` John Paul Adrian Glaubitz via openSUSE Factory ` Joe Salmeri ` John Paul Adrian Glaubitz via openSUSE Factory ` Joe Salmeri ` Dominique Leuenberger ` Jiri Slaby ` Dominique Leuenberger ` John Paul Adrian Glaubitz via openSUSE Factory ` Dominique Leuenberger ` John Paul Adrian Glaubitz via openSUSE Factory ` Joe Salmeri ` Andreas Stieger via openSUSE Factory ` Fritz Hudnut ` Knurpht-openSUSE ` Fritz Hudnut ` Knurpht-openSUSE ` Ben Greiner ` Andrei Borzenkov ` Ben Greiner ` Eric Schirra ` Fritz Hudnut ` Atri Bhattacharya
| From: | Ana Guerrero Lopez via openSUSE Factory <factory-AT-lists.opensuse.org> | |
| To: | factory-AT-lists.opensuse.org | |
| Subject: | xz security alert and CVE-2024-3094 | |
| Date: | Fri, 29 Mar 2024 18:20:27 +0100 | |
| Message-ID: | <5d7acd45-7021-4c09-8c0b-6f4b8797aecd@suse.com> |
Hi, If you're using an up-to-date Tumbleweed, please make sure to update as soon as possible your system. The latest versions of "xz" (5.6.0 and 5.6.1) contained malicious code ( refer to CVE-2024-3094 ) and the package in Tumbleweed has been reverted back to version 5.4. After reading this mail, please update your system and ensure you're downgrading xz to the version *5.6.1.revertto5.4. *This version despite**itsname is version 5.4. Last step is reboot your system. Hopefully we'll have soon more detailed information about this CVE. Have a nice weekend! Ana from the openSUSE release team.