CVE-2024-3094: Malicious code in xz 5.6.0 and 5.6.1 tarballs

discourse.nixos.org

There is currently an ongoing discussion on various platforms about a security issue in xz/liblzma, and here is what we know at this time. This post serves as a way to inform the community about our assessment of the impact on nixpkgs. Summary It was discovered that xz from version 5.6.0 started shipping malicious code that would only be executed through its release tarballs. A malicious code path would be executed when running configure and modify the resulting liblzma library. Impact NixOS 2...