thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

XZ Utils Backdoor

A 2024 supply chain compromise (CVE-2024-3094) in which a long-term contributor inserted a backdoor into the xz/liblzma compression library.

Definition

Over roughly two years the attacker gained maintainer trust, then hid the backdoor in test files and release tarballs (not the visible Git source). It targeted OpenSSH via systemd linking on some Linux distributions and was discovered before wide release by an engineer investigating SSH latency.

Example

Distributions rolled back xz to 5.4.x after the backdoor was found in 5.6.0 and 5.6.1.

Exam tip

Shows social engineering of maintainers and differences between release tarballs and source repositories.

Related terms