thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

BFergerson

interface Z {}
interface N<x> {}
interface L<x> {}
interface Qlr<x> {}
interface Qrl<x> {}
interface E<x> extends
        Qlr<N<?super Qr<?super E<?super E<?super x>>>>>,
        Qrl<N<?super Ql<?super E<?super E<?super x>>>>> {}
interface Ql<x> extends
        L<N<?super Ql<?super L<?super N<?super x>>>>>,

weblancaster

#stop all containers:
docker kill $(docker ps -q)

#remove all containers
docker rm $(docker ps -a -q)

#remove all docker images
docker rmi $(docker images -q)

monperrus

package cse;

import java.util.List;

/**
 * CodeQuery specifies a list of methods for querying source code. 
 * It is designed with Java in mind but should work with many other languages as well.
 * The metamodel of code abstracts over the language (see in TypeKind for example).
 * The queries are inspired from Eclipse Java Search.
 * 

amcgregor

Alice's Laws

1. You can only count on yourself.
2. Never reveal more than you have to.
3. Execution is nine-tenths of the job.
4. Give credit where credit is due.
5. When all else fails, do it yourself.
6. 90% of a project takes 90% of the time.
7. The remaining 10% takes an additional 90% of the time.
8. Never date a co-worker.