Pablo Hinojosa Pablohn26

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

Quickstart for MeiliSearch

Start

No authentication: Accepts all requests

Create a new project

poetry new <project-name>

Add a new lib

poetry add <library>

	---
	# Page meta info, like heading, footer text and nav links
	pageInfo:
	title: Dashy
	description: Welcome to your new dashboard!
	navLinks:
	- title: GitHub
	path: https://github.com/Lissy93/dashy
	- title: Documentation
	path: https://dashy.to/docs

	# Generate a unique private key (KEY)
	sudo openssl genrsa -out mydomain.key 2048

	# Generating a Certificate Signing Request (CSR)
	sudo openssl req -new -key mydomain.key -out mydomain.csr

	# Creating a Self-Signed Certificate (CRT)
	openssl x509 -req -days 365 -in mydomain.csr -signkey mydomain.key -out mydomain.crt

	# Append KEY and CRT to mydomain.pem

	TF=`mktemp` && wget "https://hndl.urbackup.org/Client/2.0.36/UrBackup%20Client%20Linux%202.0.36.sh" -O $TF && sh $TF; rm $TF

	urbackupclientctl add-backupdir -x -f -d /home
	urbackupclientctl add-backupdir -x -f -d /root
	urbackupclientctl add-backupdir -x -f -d /etc
	urbackupclientctl add-backupdir -x -f -d /var

	FROM ubuntu:trusty
	RUN \
	apt-get update \
	&& apt-get -y install gettext-base \
	&& apt-get clean \
	&& rm -rf /var/lib/apt/lists/*

	ENV VALUE=foo
	ENV VALUE1=boo
	COPY config.txt source_config.txt

	#!/bin/bash
	set -e

	JAVA_HOME=${1-text}
	[ $# -eq 0 ] && { echo "Usage: sudo $0 \$(/usr/libexec/java_home -v '1.8*')" ; exit 1; }

	KEYSTORE=$JAVA_HOME/jre/lib/security/cacerts

	wget https://letsencrypt.org/certs/letsencryptauthorityx1.der
	wget https://letsencrypt.org/certs/letsencryptauthorityx2.der