# Recent xz exploit? **URL:** \ **Category:** General Discussion\ **Created:** [5 April 2024 18:20 UTC](https://dietpi.com/forum/t/recent-xz-exploit/19815 "2024-04-05T18:20:26Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Zallures](https://dietpi.com/forum/letter_avatar_proxy/v4/letter/z/ecd19e/32.png) [@Zallures](https://dietpi.com/forum/u/Zallures)\ **Post date:** [5 April 2024 18:20 UTC](https://dietpi.com/forum/t/recent-xz-exploit/19815/1 "2024-04-05T18:20:26Z")
Any word about whether the latest dietpi versions are effected by this latest exploit? ---
**Author:** ![b9AcE](https://dietpi.com/forum/user_avatar/dietpi.com/b9ace/32/9193_2.png) [@b9AcE](https://dietpi.com/forum/u/b9AcE)\ **Post date:** [5 April 2024 18:41 UTC](https://dietpi.com/forum/t/recent-xz-exploit/19815/2 "2024-04-05T18:41:17Z")
When I checked on a device running DietPi just after the xz issue was announced to the general public, the installed version was too old to be affected by the backdoor, both before and after updating software, meaning “no”, to the best of my knowledge. ---
**Author:** ![Joulinar](https://dietpi.com/forum/user_avatar/dietpi.com/joulinar/32/57_2.png) [@Joulinar](https://dietpi.com/forum/u/Joulinar)\ **Post date:** [5 April 2024 18:58 UTC](https://dietpi.com/forum/t/recent-xz-exploit/19815/3 "2024-04-05T18:58:58Z")
We don’t maintain these packages ourselves. DietPi is a set of scripts on top of Debian. Means you can check Debian global repository for version available. ---
**Author:** ![Zallures](https://dietpi.com/forum/letter_avatar_proxy/v4/letter/z/ecd19e/32.png) [@Zallures](https://dietpi.com/forum/u/Zallures)\ **Post date:** [5 April 2024 18:59 UTC](https://dietpi.com/forum/t/recent-xz-exploit/19815/4 "2024-04-05T18:59:23Z")
well if that’s the case, it’s a blessing… but I’ll it a few days, and see if there’s anything “on site” about it…there should be within a day or two either way ---
**Author:** ![Zallures](https://dietpi.com/forum/letter_avatar_proxy/v4/letter/z/ecd19e/32.png) [@Zallures](https://dietpi.com/forum/u/Zallures)\ **Post date:** [5 April 2024 19:00 UTC](https://dietpi.com/forum/t/recent-xz-exploit/19815/5 "2024-04-05T19:00:59Z")
yeah ok I’ll do that…thanks for the idea ---
**Author:** ![Jappe](https://dietpi.com/forum/user_avatar/dietpi.com/jappe/32/1788_2.png) [@Jappe](https://dietpi.com/forum/u/Jappe)\ **Post date:** [5 April 2024 19:28 UTC](https://dietpi.com/forum/t/recent-xz-exploit/19815/6 "2024-04-05T19:28:54Z")
Debian stable is not affected as far as I know. ---
**Author:** ![Zallures](https://dietpi.com/forum/letter_avatar_proxy/v4/letter/z/ecd19e/32.png) [@Zallures](https://dietpi.com/forum/u/Zallures)\ **Post date:** [5 April 2024 19:36 UTC](https://dietpi.com/forum/t/recent-xz-exploit/19815/7 "2024-04-05T19:36:37Z")
it appears that the debian stable release isn’t affected you wouldn’t happen to know if the latest dietpi versin was built using the stable version would ---
**Author:** ![Zallures](https://dietpi.com/forum/letter_avatar_proxy/v4/letter/z/ecd19e/32.png) [@Zallures](https://dietpi.com/forum/u/Zallures)\ **Post date:** [5 April 2024 19:40 UTC](https://dietpi.com/forum/t/recent-xz-exploit/19815/8 "2024-04-05T19:40:18Z")
well running the test listed at > **[XZ Utils Backdoor - critical SSH vulnerability (CVE-2024-3094)](https://pentest-tools.com/blog/xz-utils-backdoor-cve-2024-3094)** > > Here are all the details about the XZ Utils Backdoor (CVE-2024-3094): timeline of events, technical specs, who's been impacted, and how you can achieve RCE. on my dietpi says it’s unaffected…in fact it’s it uses older library files, from well before this exploit was released and the version I’m using 9.1.1 ---
**Author:** ![Joulinar](https://dietpi.com/forum/user_avatar/dietpi.com/joulinar/32/57_2.png) [@Joulinar](https://dietpi.com/forum/u/Joulinar)\ **Post date:** [5 April 2024 19:44 UTC](https://dietpi.com/forum/t/recent-xz-exploit/19815/9 "2024-04-05T19:44:16Z")
> [@Zallures](#): > > debian stable release isn’t affected you wouldn’t happen to know if the latest dietpi versin was built using the stable version To avoid a misunderstanding. DietPi is not an own operating system that is built on some source. It’s just a set of scripts running on Debian and we use Debian global package repository. [Debian -- Packages](https://www.debian.org/distrib/packages) We don’t maintain, build or manage any of these packages. Furthermore, DietPi version has no relation to any Debian package version. These are completely different thinks. For 32bit RPi, we use Raspberry OS (source packages). ---
**Author:** ![Jappe](https://dietpi.com/forum/user_avatar/dietpi.com/jappe/32/1788_2.png) [@Jappe](https://dietpi.com/forum/u/Jappe)\ **Post date:** [5 April 2024 19:58 UTC](https://dietpi.com/forum/t/recent-xz-exploit/19815/10 "2024-04-05T19:58:15Z")
Also to get a better understanding what is now vulnerable and what not: Only the release tar-balls are affected, the malicious package made it not to version control. Also you, as a package maintainer, would need to build software, which depends on liblzma 5.6.0. or 5.6.1, with the malicous tar balls from github, to create a backdoor’d binary. So just installing `xz-utils` from debian testing/sid would make you not vulnerable. [source](https://youtu.be/LaRKIwpGPTU?si=6xh1doA6-IE6ADNx&t=667) ---
**Author:** ![Zallures](https://dietpi.com/forum/letter_avatar_proxy/v4/letter/z/ecd19e/32.png) [@Zallures](https://dietpi.com/forum/u/Zallures)\ **Post date:** [5 April 2024 20:02 UTC](https://dietpi.com/forum/t/recent-xz-exploit/19815/11 "2024-04-05T20:02:03Z")
well watching the dietpi installer, it’s pretty easy to see what it is by watching what it’s installing from where,and I really like the optimized packages. Wasn’t trying to start trouble or a panic…but felt it was important enough to ask about…so I started digging and reported what I found…and they might want to put something about it on the website… ---
**Author:** ![Joulinar](https://dietpi.com/forum/user_avatar/dietpi.com/joulinar/32/57_2.png) [@Joulinar](https://dietpi.com/forum/u/Joulinar)\ **Post date:** [10 April 2024 22:26 UTC](https://dietpi.com/forum/t/recent-xz-exploit/19815/12 "2024-04-10T22:26:22Z")
Just to round this up, the Debian security tracker overview [https://security-tracker.debian.org/tracker/CVE-2024-3094](https://security-tracker.debian.org/tracker/CVE-2024-3094) ---
**Author:** ![system](https://dietpi.com/forum/uploads/default/original/1X/7e1021de2213860bce185915ce2c1786e56490ec.png) [@system](https://dietpi.com/forum/u/system)\ **Post date:** [9 July 2024 22:26 UTC](https://dietpi.com/forum/t/recent-xz-exploit/19815/13 "2024-07-09T22:26:35Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.