thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

giovtorres

{
  "id": 23,
  "title": "SLURM Scheduler Statistics",
  "originalTitle": "SLURM Scheduler Statistics",
  "tags": [
    "Slurm"
  ],
  "style": "dark",
  "timezone": "browser",
  "editable": true,

giovtorres

#!/usr/bin/python
# vim: set ts=4 sw=4 et

"""
slurm_sched_stats.py
A script that uses PySlurm to get the slurm scheduler statistics.
"""

import pickle
import socket

jpeddicord

// additional required configuration to hook into the build script
android {
	signingConfigs {
		release
	}

	buildTypes {
		release {
			signingConfig signingConfigs.release
		}

caniszczyk

curl -s https://api.github.com/orgs/twitter/repos?per_page=200 | ruby -rubygems -e 'require "json"; JSON.load(STDIN.read).each { |repo| %x[git clone #{repo["ssh_url"]} ]}'

suda

#!/sbin/runscript

# Gunicorn init.d script for gentoo
# Written by Wojtek 'suda' Siudzinski <admin@suda.pl>
# Gist: https://gist.github.com/748335
#
# Sample config (/etc/conf.d/gunicorn):
#
# SERVERS=(
#	'server_name	port	project_path	number_of_workers'

ekohl

#!/usr/bin/python
from BeautifulSoup import BeautifulSoup
import portage
import urllib2

url = 'http://www.gentoo.org/proj/en/qa/treecleaners/maintainer-needed.xml'

# Build a to remove set
f = urllib2.urlopen(url)
soup = BeautifulSoup(f.read())