All about the xz-utils backdoor

The . This backdoor could potentially allow a malicious actor to compromise sshd authentication, granting unauthorized access to the entire system remotely.

With a library this widely used, the severity of this vulnerability poses a threat to the entire Linux ecosystem. Luckily, this issue was caught quickly so the impact was significantly less than it could have been. It has already been patched in Debian, and therefore, Kali Linux.

The impact of this vulnerability affected Kali between March 26th to March 29th, during which time

Should you wish to check if you have the vulnerable version installed, we can perform the following command:

kali@kali:~$ apt-cache policy liblzma5

liblzma5:

 Installed: 5.4.5-0.3

 Candidate: 5.6.1+really5.4.5-1

 Version table:

    5.6.1+really5.4.5-1 500

       500 http://kali.download/kali kali-rolling/main amd64 Packages

*** 5.4.5-0.3 100

       100 /var/lib/dpkg/status

If we see the version 5.6.0-0.2 next to Installed: then we must upgrade to the latest version, 5.6.1+really5.4.5-1. We can do this with the following commands:

kali@kali:~$ sudo apt update && sudo apt install -y --only-upgrade liblzma5

...

kali@kali:~$

More information can be found at for the initial disclosure, and NIST’s NVD entry for this vulnerability.