Sebastian Pipping hartwork

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

Container security notes

Internet references

Kernel and architecture

namespaces - overview of Linux namespaces http://man7.org/linux/man-pages/man7/namespaces.7.html
mount_namespaces - overview of Linux mount namespaces

After reading Why I'm Frequently Absent from Open Source by James Long and listening the corresponding The Changelog episode, I dwelt on the idea and believe that open source maintainers...

... should never be ashamed if they don't have time for a project.
... should be honest with themselves and open with their users so that everybody can be on the same page
... are people and they have at one time or another responsibilities or hardships that they need to attend to which reasonably take them away from a project
... may also reasonbly decide that they don't like the direction of a project or that they would like to explore other things and may leave a project permanently.

Along this line of thinking I've created a set of descriptions for different levels at which a project might be maintained. A maintainer can use these to announce to their users the current ability that they have to dedicate to a pr

	'''Licensed under the MIT License :)'''

	import pefile
	import pprint
	pe = pefile.PE('example.exe')


	string_version_info = {}

	for fileinfo in pe.FileInfo[0]:

	# taken from http://www.piware.de/2011/01/creating-an-https-server-in-python/
	# generate server.xml with the following command:
	# openssl req -new -x509 -keyout server.pem -out server.pem -days 365 -nodes
	# run as follows:
	# python simple-https-server.py
	# then in your browser, visit:
	# https://localhost:4443

	import BaseHTTPServer, SimpleHTTPServer
	import ssl