- Advisory ID: CV_2024_04_1
- Issued: 2024-04-02
- Updated: 2024-04-02
- Additional Links:
The Commvault software does not use the RHEL xz versions 5.6.0 and 5.6.1 and is unaffected by this vulnerability.
Impacted Products
This vulnerability does not affect Commvault products.
CVE Details
| Info | Description |
|---|---|
| Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library. |