thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

betafcc

from __future__ import annotations

from typing import (
    Any,
    Awaitable,
    Callable,
    Iterable,
    Literal,
    Mapping,
    ParamSpec,

kovetskiy

#!/bin/bash
###
### my-script — does one thing well
###
### Usage:
###   my-script <input> <output>
###
### Options:
###   <input>   Input file to read.
###   <output>  Output file to write. Use '-' for stdout.

alex

Most downloaded projects

SELECT
  file.project,
  COUNT(*) as total_downloads,
FROM
  TABLE_DATE_RANGE(
    [the-psf:pypi.downloads],
    TIMESTAMP("20160114"),

dabeaz

# aecho.py

from socket import *
import asyncio

loop = asyncio.get_event_loop()

async def echo_server(address):
    sock = socket(AF_INET, SOCK_STREAM)
    sock.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)

gdamjan

import aiohttp
import asyncio

async def get_body(url):
    response = await aiohttp.request('GET', url)
    raw_html = await response.read()
    return raw_html

async def main():
    # run them sequentially (but the loop can do other stuff in the meanwhile)

genme

CREATE OR REPLACE FUNCTION check_fk_child() RETURNS trigger AS $$
DECLARE
  fk_local TEXT := TG_ARGV[0];
  parent_table TEXT := TG_ARGV[1];
  fk_val INT;
  is_valid BOOLEAN;
  query TEXT;
BEGIN
  -- fk_val = getattr(NEW, fk_local)
  EXECUTE format('SELECT $1.%I', fk_local) USING NEW INTO fk_val;

vvo

# sets the proxy cache path location, max size 2g
proxy_cache_path  /data/nginx/cache  levels=1:2 keys_zone=STATIC:100m inactive=24h max_size=2g;

# transfers the `Host` header to the backend
proxy_set_header        Host $host;

# uses the defined STATIC cache zone
proxy_cache             STATIC;

# cache 200 10 minutes, 404 1 minute, others status codes not cached

gavinwahl

CREATE OR REPLACE FUNCTION check_fk_child() RETURNS trigger AS $$
DECLARE
  fk_local TEXT := TG_ARGV[0];
  parent_table TEXT := TG_ARGV[1];
  fk_val INT;
  is_valid BOOLEAN;
  query TEXT;
BEGIN
  -- fk_val = getattr(NEW, fk_local)
  EXECUTE format('SELECT $1.%I', fk_local) USING NEW INTO fk_val;

wrenoud

import os
import sys
import pickle
import console

# I moved 'dropboxlogin' into a sub folder so it doesn't clutter my main folder
sys.path += [os.path.join(os.path.dirname(os.path.abspath(__file__)), 'lib')]
import dropboxlogin # this code can be found here https://gist.github.com/4034526

STATE_FILE = '.dropbox_state'