XZ Utils supply chain compromise (CVE-2024-3094)
Advisory ID
WGSA-2024-00007
CVE
CVE-2024-3094
Impact
Critical
Status
Not Applicable
Product Family
Firebox,
Endpoint,
WatchGuard Cloud,
Dimension,
Secure Wi-Fi
Published Date
Updated Date
Workaround Available
False
CVSS Score
10.0
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Summary
On March 29, a software engineer at Microsoft discovered and disclosed a supply chain attack against the popular Linux decompression utility XZ Utils. After analysis, researchers confirmed a rogue developer had inserted malicious code into the 5.6.0 and 5.6.1 releases of XZ Utils. This malicious code could allow an adversary with a carefully crafted SSH public key to execute arbitrary code with SYSTEM permissions on affected Linux-based systems.
Affected
No WatchGuard products use the affected versions of XZ Utils
Resolution
No resolution necessary
Advisory Product List
Product Family
Product Branch
Product List
Firebox
XTM 8 Series (2nd Gen)
XTM850,
XTM860,
XTM870,
XTM870-F
Firebox
XTM 1500 and 2520
XTM1520-RP,
XTM1525-RP,
XTM2520
Firebox
Firebox T (1st Gen)
T10,
T10-W,
T10-D,
T30,
T30-W,
T50,
T50-W
Firebox
Firebox T (3rd Gen)
T20,
T20-W,
T40,
T40-W,
T80
Firebox
Firebox M (1st Gen)
M200,
M300,
M400,
M440,
M500
Firebox
Firebox M (2nd Gen)
M270,
M370,
M470,
M570,
M670
Firebox
Firebox T (2nd Gen)
T15,
T15-W,
T35,
T35-W,
T35-R,
T55,
T55-W,
T70
Firebox
Firebox M (3rd Gen)
M290,
M390,
M590,
M690,
M4800,
M5800
Firebox
FireboxV
Small,
Medium,
Large,
XLarge
Firebox
XTMv
Small,
Medium,
Large,
Datacenter
Firebox
FireboxCloud
Small,
Medium,
Large,
XLarge
Firebox
Firebox T (4th Gen)
NV5,
T25,
T45,
T85
Endpoint
Panda Dome
Essential,
Advanced,
Complete,
Premium
Endpoint
Panda AD360
AD360
Endpoint
WatchGuard EPDR
EPP,
EDR,
EPDR
WatchGuard Cloud
WatchGuard Cloud
WatchGuard Cloud
WatchGuard Cloud
DNSWatch
DNSWatch
Dimension
Dimension
Dimension
Secure Wi-Fi
Wi-Fi 6
AP130,
AP330,
AP430CR,
AP432
Secure Wi-Fi
Wi-Fi 4 & 5
AP322,
AP420,
AP125,
AP225W,
AP325,
AP327X