Reported Supply Chain Compromise Affecting XZ Utils Data Compression Library

CISA and the open source community are responding to reports of malicious code being embedded in XZ Utils versions 5.6.0 and 5.6.1. This activity was assigned CVE-2024-3094
. XZ Utils is data compression software and may be present in Linux distributions. The malicious code may allow unauthorized access to affected systems.

https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094

access cisa code community compression compromise cve cve-2024 cybersecurity data data compression distributions embedded library linux linux distributions malicious may open source reports software supply supply chain supply chain compromise unauthorized unauthorized access