# Arch Linux: The xz package has been backdoored

**URL:** <https://forum.devtalk.com/t/arch-linux-the-xz-package-has-been-backdoored/149359>\
**Category:** Linux Official News\
**Tags:** linux, arch, arch-linux, official-news\
**Created:** [29 March 2024 19:04 UTC](https://forum.devtalk.com/t/arch-linux-the-xz-package-has-been-backdoored/149359 "2024-03-29T19:04:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![NewsBot](https://forum.devtalk.com/user_avatar/forum.devtalk.com/newsbot/32/1114_2.png) [@NewsBot](https://forum.devtalk.com/u/NewsBot)\
**Post date:** [29 March 2024 19:04 UTC](https://forum.devtalk.com/t/arch-linux-the-xz-package-has-been-backdoored/149359/1 "2024-03-29T19:04:32Z")

</div>

A new [Arch Linux](https://devtalk.com/arch-linux) blog post/announcement has been posted!

> To determine if you are affected, run the following:

```auto
% xz --version
xz (XZ Utils) 5.4.4
liblzma 5.4.4

```

> If you see `5.6.0` or `5.6.1`, you are vulnerable and you need to downgrade.

* * *

> [@](#):
>
> TL;DR: Upgrade your systems and container images **now**!
> 
> As many of you may have already read [1](https://www.openwall.com/lists/oss-security/2024/03/29/4), the upstream release tarballs for `xz` in version `5.6.0` and `5.6.1` contain malicious code which adds a backdoor.
> 
> This vulnerability is tracked in the Arch Linux security tracker [2](https://security.archlinux.org/ASA-202403-1).
> 
> The `xz` packages prior to version `5.6.1-2` (specifically `5.6.0-1` and `5.6.1-1`) contain this backdoor.
> 
> The following release artifacts contain the compromised `xz`:
> 
> - installation medium `2024.03.01`
> - virtual machine images `20240301.218094` and `20240315.221711`
> - container images created between and including _2024-02-24_ and _2024-03-28_
> 
> The affected release...

Get the full details here: [Arch Linux - News: The xz package has been backdoored](https://archlinux.org/news/the-xz-package-has-been-backdoored/)

---

<div class="post-metadata">

**Author:** ![Eiji](https://forum.devtalk.com/user_avatar/forum.devtalk.com/eiji/32/6784_2.png) [@Eiji](https://forum.devtalk.com/u/Eiji)\
**Post date:** [1 April 2024 18:22 UTC](https://forum.devtalk.com/t/arch-linux-the-xz-package-has-been-backdoored/149359/2 "2024-04-01T18:22:19Z")

</div>

Original topic on `Elixir` forum:

> **[Backdoor in the xz library - check your environments](https://elixirforum.com/t/backdoor-in-the-xz-library-check-your-environments/62627/8)**
>
> How about pin those topics on all forums @AstonJ? Also mentioned by bot on devtalk:

Cross-posted on `Erlang` forums:

> **[Backdoor in the xz library (a dependency in Erlang/Elixir)](https://erlangforums.com/t/backdoor-in-the-xz-library-a-dependency-in-erlang-elixir/3444)**
>
> Cross-posting this from EF:

---

<div class="post-metadata">

**Author:** ![AstonJ](https://forum.devtalk.com/user_avatar/forum.devtalk.com/astonj/32/7_2.png) [@AstonJ](https://forum.devtalk.com/u/AstonJ)\
**Post date:** [1 April 2024 18:53 UTC](https://forum.devtalk.com/t/arch-linux-the-xz-package-has-been-backdoored/149359/3 "2024-04-01T18:53:44Z")

</div>