Wrong xz-libs 5.4.6 version showing as vulnerable #6448
Replies: 2 comments 3 replies
-
|
Alpine advisories define fixed versions only as below. This means that older versions rather than fixed version are considered vulnerable. Trivy relies on public advisories. We cannot handle this kind of case. |
Beta Was this translation helpful? Give feedback.
-
|
So anything not 5.6.1-r2 would show as vulnerable? That doesn't seem right. |
Beta Was this translation helpful? Give feedback.
-
|
Unfortunately, yes, but it happens only for edge. Your image installs packages from the edge repository, while the OS version is 3.19. Mixing versions is not a recommended usage. In this case, Trivy uses security advisories for edge as the packages actually come from edge. If you switch the repository to 3.19, the vulnerability will not be detected. |
Beta Was this translation helpful? Give feedback.
-
|
Alright, that works for me. Thanks for the information, this can be closed in that case. |
Beta Was this translation helpful? Give feedback.
-
|
#6442 |
Beta Was this translation helpful? Give feedback.
-
IDs
CVE-2024-3094
Description
The xz-libs version 5.4.6 should not be vulnerable to the CVE-2024-3094. The vulnerable versions are 5.6.0 and 5.6.1.
Here Trivy shows the following library as vulnerable:
Here is the json for the CVE:
{ "VulnerabilityID": "CVE-2024-3094", "PkgID": "[email protected]", "PkgName": "xz-libs", "PkgIdentifier": { "PURL": "pkg:apk/alpine/[email protected]?arch=x86_64\u0026distro=3.19.0" }, "InstalledVersion": "5.4.6-r0", "FixedVersion": "5.6.1-r2", "Status": "fixed", "Layer": { "Digest": "sha256:995df079f4e4403e9c5654042334d4c4b70926701c754e1f18f4a1e21bf44206", "DiffID": "sha256:04c6fd2803baee333d2e628bee819904d804e8ffa1b28397d6dc77ec2311c2d6" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-3094", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Title": "xz: malicious code in distributed source", "Description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. \r\nThrough a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.", "Severity": "CRITICAL", "CweIDs": [ "CWE-506" ], "VendorSeverity": { "nvd": 4, "redhat": 4 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "V3Score": 10 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "V3Score": 10 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2024-3094", "https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/", "https://aws.amazon.com/security/security-bulletins/AWS-2024-002/", "https://boehs.org/node/everything-i-know-about-the-xz-backdoor", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024", "https://bugs.gentoo.org/928134", "https://bugzilla.redhat.com/show_bug.cgi?id=2272210", "https://bugzilla.suse.com/show_bug.cgi?id=1222124", "https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405", "https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27", "https://github.com/advisories/GHSA-rxwq-x6h5-x525", "https://github.com/amlweems/xzbot", "https://github.com/karcherm/xz-malware", "https://gynvael.coldwind.pl/?lang=en\u0026id=782", "https://lists.debian.org/debian-security-announce/2024/msg00057.html", "https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html", "https://lwn.net/Articles/967180/", "https://news.ycombinator.com/item?id=39865810", "https://news.ycombinator.com/item?id=39877267", "https://news.ycombinator.com/item?id=39895344", "https://nvd.nist.gov/vuln/detail/CVE-2024-3094", "https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/", "https://security-tracker.debian.org/tracker/CVE-2024-3094", "https://security.alpinelinux.org/vuln/CVE-2024-3094", "https://security.archlinux.org/CVE-2024-3094", "https://tukaani.org/xz-backdoor/", "https://twitter.com/LetsDefendIO/status/1774804387417751958", "https://twitter.com/debian/status/1774219194638409898", "https://twitter.com/infosecb/status/1774595540233167206", "https://twitter.com/infosecb/status/1774597228864139400", "https://ubuntu.com/security/CVE-2024-3094", "https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094", "https://www.cve.org/CVERecord?id=CVE-2024-3094", "https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils", "https://www.openwall.com/lists/oss-security/2024/03/29/4", "https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users", "https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils", "https://www.theregister.com/2024/03/29/malicious_backdoor_xz/", "https://www.vicarius.io/vsociety/vulnerabilities/cve-2024-3094", "https://xeiaso.net/notes/2024/xz-vuln/" ], "PublishedDate": "2024-03-29T17:15:21.15Z", "LastModifiedDate": "2024-04-01T18:15:08.13Z" }Reproduction Steps
Target
Container Image
Scanner
Vulnerability
Target OS
alpine 3.19
Debug Output
Version
Checklist
-f jsonthat shows data sources and confirmed that the security advisory in data sources was correctBeta Was this translation helpful? Give feedback.
All reactions