deploy: 9b18ff81636849b5205cd8898e4f05a70e34cdc9

affected/vulnerabilities/index.badge

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "label": "Info",
-  "message": "OK",
-  "color": "#0a0c0f",
+  "message": "Notice",
+  "color": "#4c1",
   "labelColor": "#555555",
-  "isError": false
+  "isError": true
 }

affected/vulnerabilities/index.json

@@ -1 +1 @@
-{"is":"system","title":"Vulnerabilities","permalink":"https://info.linuxserver.io/affected/vulnerabilities/","status":"ok","pages":[{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2022-02-18 16:19:06 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":true,"informational":false,"resolvedAt":"2022-02-18 18:00:00Z","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"Authelia Vulnerability","createdAt":"2021-05-30 00:00:00 +0000 UTC","lastMod":"2021-05-30 16:53:02 +0100 +0100","permalink":"https://info.linuxserver.io/issues/2021-05-30-authelia/","severity":"notice","resolved":true,"informational":false,"resolvedAt":"2021-05-30","affected":["Vulnerabilities","authelia","swag"],"filename":"2021-05-30-authelia.md"}]}
+{"is":"system","title":"Vulnerabilities","permalink":"https://info.linuxserver.io/affected/vulnerabilities/","status":"notice","pages":[{"is":"issue","title":"Regarding CVE-2024-3094 - Supply Chain Compromise Affecting XZ Utils","createdAt":"2024-03-29 22:00:00 +0000 UTC","lastMod":"2024-03-29 20:30:57 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2024-03-29-cve-2024-3094/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities"],"filename":"2024-03-29-cve-2024-3094.md"},{"is":"issue","title":"log4j Vulnerability","createdAt":"2021-12-13 15:00:00 +0000 UTC","lastMod":"2022-02-18 16:19:06 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2021-12-13-log4j/","severity":"notice","resolved":true,"informational":false,"resolvedAt":"2022-02-18 18:00:00Z","affected":["Vulnerabilities","unifi-controller","booksonic-air","fleet","airsonic","habridge","nzbhydra2","davos","booksonic","ubooquity"],"filename":"2021-12-13-log4j.md"},{"is":"issue","title":"Authelia Vulnerability","createdAt":"2021-05-30 00:00:00 +0000 UTC","lastMod":"2021-05-30 16:53:02 +0100 +0100","permalink":"https://info.linuxserver.io/issues/2021-05-30-authelia/","severity":"notice","resolved":true,"informational":false,"resolvedAt":"2021-05-30","affected":["Vulnerabilities","authelia","swag"],"filename":"2021-05-30-authelia.md"}]}

affected/vulnerabilities/index.svg

@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" height="2em" width="21ex" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11"><linearGradient id="b" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="a"><rect width="100%" height="100%" rx="3" fill="#fff"/></clipPath><g clip-path="url(#a)" fill="#fff"><rect x="0" y="0" width="100%" height="100%" fill="#555"/><rect x="17ex" y="0" height="100%" width="100%" fill="green"/><rect x="0" y="0" width="100%" height="100%" fill="url(#b)"/><text x="1ex" y="15" fill="#010101" fill-opacity=".3">Vulnerabilities</text><text x="1ex" y="14">Vulnerabilities</text><text x="18ex" y="15" fill="#010101" fill-opacity=".3">OK</text><text x="18ex" y="14">OK</text></g></svg>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" height="2em" width="25ex" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11"><linearGradient id="b" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="a"><rect width="100%" height="100%" rx="3" fill="#fff"/></clipPath><g clip-path="url(#a)" fill="#fff"><rect x="0" y="0" width="100%" height="100%" fill="#555"/><rect x="17ex" y="0" height="100%" width="100%" fill="#24478f"/><rect x="0" y="0" width="100%" height="100%" fill="url(#b)"/><text x="1ex" y="15" fill="#010101" fill-opacity=".3">Vulnerabilities</text><text x="1ex" y="14">Vulnerabilities</text><text x="18ex" y="15" fill="#010101" fill-opacity=".3">Notice</text><text x="18ex" y="14">Notice</text></g></svg>

affected/vulnerabilities/index.xml

@@ -1,4 +1,15 @@
-<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><link rel="alternate" type="text/html" href="https://info.linuxserver.io"/><title>Vulnerabilities on Info :: LinuxServer.io</title><link>https://info.linuxserver.io/affected/vulnerabilities/</link><description>History</description><generator>github.com/cstate</generator><language>en</language><lastBuildDate>2021-12-13T15:00:00+00:00</lastBuildDate><updated>2021-12-13T15:00:00+00:00</updated><atom:link href="https://info.linuxserver.io/affected/vulnerabilities/index.xml" rel="self" type="application/rss+xml"/><item><title>[Resolved] log4j Vulnerability</title><link>https://info.linuxserver.io/issues/2021-12-13-log4j/</link><pubDate>Mon, 13 Dec 2021 15:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2021-12-13-log4j/</guid><category>2022-02-18 18:00:00Z</category><description>Update At this time we have determined that all application/container updates or mitigations that we can reasonably provide have been actioned and as such are marking this issue as resolved.
+<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><link rel="alternate" type="text/html" href="https://info.linuxserver.io"/><title>Vulnerabilities on Info :: LinuxServer.io</title><link>https://info.linuxserver.io/affected/vulnerabilities/</link><description>History</description><generator>github.com/cstate</generator><language>en</language><lastBuildDate>2024-03-29T22:00:00+00:00</lastBuildDate><updated>2024-03-29T22:00:00+00:00</updated><atom:link href="https://info.linuxserver.io/affected/vulnerabilities/index.xml" rel="self" type="application/rss+xml"/><item><title>Regarding CVE-2024-3094 - Supply Chain Compromise Affecting XZ Utils</title><link>https://info.linuxserver.io/issues/2024-03-29-cve-2024-3094/</link><pubDate>Fri, 29 Mar 2024 22:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2024-03-29-cve-2024-3094/</guid><category/><description>A supply chain compromise has been discovered in the XZ Utils data compression library, being tracked under CVE-2024-3094, which could allow remote code execution under certain circumstances. The original report is available here if you are interested in the technical details.
+We have evaluated all of our current base images for indications that they may be vulnerable to this exploit:
+Our Ubuntu, Debian, and Fedora base images are using older versions of XZ Utils which do not appear to contain the vulnerable code.</description><content type="html">&lt;p>A supply chain compromise has been discovered in the XZ Utils data compression library, being tracked under &lt;a href="https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094">CVE-2024-3094&lt;/a>, which could allow remote code execution under certain circumstances. The original report is available &lt;a href="https://www.openwall.com/lists/oss-security/2024/03/29/4">here&lt;/a> if you are interested in the technical details.&lt;/p>
+&lt;p>We have evaluated all of our current base images for indications that they may be vulnerable to this exploit:&lt;/p>
+&lt;ul>
+&lt;li>Our Ubuntu, Debian, and Fedora base images are using older versions of XZ Utils which do not appear to contain the vulnerable code.&lt;/li>
+&lt;li>Our Arch base image did contain an affected version of XZ Utils, and we have now pushed an updated build that includes a fixed version of the XZ package.&lt;/li>
+&lt;li>Our Alpine Edge base image did contain an affected version of XZ Utils, but did not appear to be vulnerable due to the exploit&amp;rsquo;s dependency on glibc, and we have now pushed an updated build that includes a fixed version of the XZ package.&lt;/li>
+&lt;li>Our other Alpine base images are using older versions of XZ Utils which do not appear to contain the vulnerable code.&lt;/li>
+&lt;/ul>
+&lt;p>So far the only exploitation path that has been observed is via SSH, and so in the vast majority of cases could not be exploited in any of our container environments, but we always recommend that you ensure any internet-facing containers are properly secured and kept up to date.&lt;/p>
+&lt;p>We will update this post as and when more information becomes available.&lt;/p></content></item><item><title>[Resolved] log4j Vulnerability</title><link>https://info.linuxserver.io/issues/2021-12-13-log4j/</link><pubDate>Mon, 13 Dec 2021 15:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2021-12-13-log4j/</guid><category>2022-02-18 18:00:00Z</category><description>Update At this time we have determined that all application/container updates or mitigations that we can reasonably provide have been actioned and as such are marking this issue as resolved.
 Original Post Multiple vulnerabilities (CVE-2021-44228 and CVE-2021-45046) have been discovered in log4j which can lead to denial of service and remote code execution. The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 or CVE-2021-45046 due to existing mitigations, upstream patches, or workarounds applied to the container images.</description><content type="html">&lt;h3 id="update">Update&lt;/h3>
 &lt;p>At this time we have determined that all application/container updates or mitigations that we can reasonably provide have been actioned and as such are marking this issue as resolved.&lt;/p>
 &lt;h3 id="original-post">Original Post&lt;/h3>

index.json

@@ -1 +1 @@
-{"is":"index","cStateVersion":"5.6.1","apiVersion":"2.0","title":"Info :: LinuxServer.io","languageCodeHTML":"en","languageCode":"en","baseURL":"https://info.linuxserver.io","description":"LinuxServer.io Status page","summaryStatus":"ok","categories":[{"name":"Images","description":"Information regarding our images","hideTitle":false,"closedByDefault":false},{"name":"Security","hideTitle":false,"closedByDefault":false}],"pinnedIssues":[],"systems":[{"name":"Deprecations","category":"Images","status":"ok","unresolvedIssues":[]},{"name":"New Containers","category":"Images","status":"ok","unresolvedIssues":[]},{"name":"Vulnerabilities","category":"Security","status":"ok","unresolvedIssues":[]},{"name":"Known Issues","category":"Images","status":"ok","unresolvedIssues":[]},{"name":"Notifications","category":"Images","status":"ok","unresolvedIssues":[]}],"buildDate":"2024-03-21","buildTime":"14:23","buildTimezone":"UTC","colorBrand":"#0a0c0f","colorOk":"#008000","colorDisrupted":"#cc4400","colorDown":"#e60000","colorNotice":"#24478f","alwaysKeepBrandColor":"true","logo":"https://info.linuxserver.io/logo.png","googleAnalytics":"UA-00000000-1"}
+{"is":"index","cStateVersion":"5.6.1","apiVersion":"2.0","title":"Info :: LinuxServer.io","languageCodeHTML":"en","languageCode":"en","baseURL":"https://info.linuxserver.io","description":"LinuxServer.io Status page","summaryStatus":"notice","categories":[{"name":"Images","description":"Information regarding our images","hideTitle":false,"closedByDefault":false},{"name":"Security","hideTitle":false,"closedByDefault":false}],"pinnedIssues":[],"systems":[{"name":"Deprecations","category":"Images","status":"ok","unresolvedIssues":[]},{"name":"New Containers","category":"Images","status":"ok","unresolvedIssues":[]},{"name":"Vulnerabilities","category":"Security","status":"notice","unresolvedIssues":[{"is":"issue","title":"Regarding CVE-2024-3094 - Supply Chain Compromise Affecting XZ Utils","createdAt":"2024-03-29 22:00:00 +0000 UTC","lastMod":"2024-03-29 20:30:57 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2024-03-29-cve-2024-3094/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities"],"filename":"2024-03-29-cve-2024-3094.md"}]},{"name":"Known Issues","category":"Images","status":"ok","unresolvedIssues":[]},{"name":"Notifications","category":"Images","status":"ok","unresolvedIssues":[]}],"buildDate":"2024-03-29","buildTime":"20:34","buildTimezone":"UTC","colorBrand":"#0a0c0f","colorOk":"#008000","colorDisrupted":"#cc4400","colorDown":"#e60000","colorNotice":"#24478f","alwaysKeepBrandColor":"true","logo":"https://info.linuxserver.io/logo.png","googleAnalytics":"UA-00000000-1"}

index.svg

@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" height="2em" width="28ex" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11"><linearGradient id="b" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="a"><rect width="100%" height="100%" rx="3" fill="#fff"/></clipPath><g clip-path="url(#a)" fill="#fff"><rect x="0" y="0" width="100%" height="100%" fill="#555"/><rect x="24ex" y="0" height="100%" width="100%" fill="green"/><rect x="0" y="0" width="100%" height="100%" fill="url(#b)"/><text x="1ex" y="15" fill="#010101" fill-opacity=".3">Info :: LinuxServer.io</text><text x="1ex" y="14">Info :: LinuxServer.io</text><text x="25ex" y="15" fill="#010101" fill-opacity=".3">OK</text><text x="25ex" y="14">OK</text></g></svg>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" height="2em" width="32ex" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11"><linearGradient id="b" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="a"><rect width="100%" height="100%" rx="3" fill="#fff"/></clipPath><g clip-path="url(#a)" fill="#fff"><rect x="0" y="0" width="100%" height="100%" fill="#555"/><rect x="24ex" y="0" height="100%" width="100%" fill="#24478f"/><rect x="0" y="0" width="100%" height="100%" fill="url(#b)"/><text x="1ex" y="15" fill="#010101" fill-opacity=".3">Info :: LinuxServer.io</text><text x="1ex" y="14">Info :: LinuxServer.io</text><text x="25ex" y="15" fill="#010101" fill-opacity=".3">Notice</text><text x="25ex" y="14">Notice</text></g></svg>

index.xml

@@ -1,4 +1,13 @@
-<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Info :: LinuxServer.io</title><link>https://info.linuxserver.io/</link><description>History</description><generator>github.com/cstate</generator><language>en</language><lastBuildDate>Thu, 21 Mar 2024 16:00:00 +0000</lastBuildDate><atom:link href="https://info.linuxserver.io/index.xml" rel="self" type="application/rss+xml"/><item><title>endlessh Deprecation Notice</title><link>https://info.linuxserver.io/issues/2024-03-21-endlessh/</link><pubDate>Thu, 21 Mar 2024 16:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2024-03-21-endlessh/</guid><category/><description>&lt;p>Due to a lack of upstream development, we have decided to deprecate our &lt;a href="https://github.com/linuxserver/docker-endlessh">endlessh&lt;/a> container.&lt;/p></description></item><item><title>Dillinger Deprecation Notice</title><link>https://info.linuxserver.io/issues/2024-03-20-dillinger/</link><pubDate>Wed, 20 Mar 2024 22:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2024-03-20-dillinger/</guid><category/><description>&lt;p>Due to a lack of upstream development, we have decided to deprecate our &lt;a href="https://github.com/linuxserver/docker-dillinger">dillinger&lt;/a> container.&lt;/p></description></item><item><title>New Container: Speedtest Tracker</title><link>https://info.linuxserver.io/issues/2024-02-10-speedtest-tracker/</link><pubDate>Sat, 10 Feb 2024 18:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2024-02-10-speedtest-tracker/</guid><category/><description>&lt;p>We have released a new container for &lt;a href="https://github.com/linuxserver/docker-speedtest-tracker/">Speedtest Tracker&lt;/a>!&lt;/p>
+<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Info :: LinuxServer.io</title><link>https://info.linuxserver.io/</link><description>History</description><generator>github.com/cstate</generator><language>en</language><lastBuildDate>Fri, 29 Mar 2024 22:00:00 +0000</lastBuildDate><atom:link href="https://info.linuxserver.io/index.xml" rel="self" type="application/rss+xml"/><item><title>Regarding CVE-2024-3094 - Supply Chain Compromise Affecting XZ Utils</title><link>https://info.linuxserver.io/issues/2024-03-29-cve-2024-3094/</link><pubDate>Fri, 29 Mar 2024 22:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2024-03-29-cve-2024-3094/</guid><category/><description>&lt;p>A supply chain compromise has been discovered in the XZ Utils data compression library, being tracked under &lt;a href="https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094">CVE-2024-3094&lt;/a>, which could allow remote code execution under certain circumstances. The original report is available &lt;a href="https://www.openwall.com/lists/oss-security/2024/03/29/4">here&lt;/a> if you are interested in the technical details.&lt;/p>
+&lt;p>We have evaluated all of our current base images for indications that they may be vulnerable to this exploit:&lt;/p>
+&lt;ul>
+&lt;li>Our Ubuntu, Debian, and Fedora base images are using older versions of XZ Utils which do not appear to contain the vulnerable code.&lt;/li>
+&lt;li>Our Arch base image did contain an affected version of XZ Utils, and we have now pushed an updated build that includes a fixed version of the XZ package.&lt;/li>
+&lt;li>Our Alpine Edge base image did contain an affected version of XZ Utils, but did not appear to be vulnerable due to the exploit&amp;rsquo;s dependency on glibc, and we have now pushed an updated build that includes a fixed version of the XZ package.&lt;/li>
+&lt;li>Our other Alpine base images are using older versions of XZ Utils which do not appear to contain the vulnerable code.&lt;/li>
+&lt;/ul>
+&lt;p>So far the only exploitation path that has been observed is via SSH, and so in the vast majority of cases could not be exploited in any of our container environments, but we always recommend that you ensure any internet-facing containers are properly secured and kept up to date.&lt;/p>
+&lt;p>We will update this post as and when more information becomes available.&lt;/p></description></item><item><title>endlessh Deprecation Notice</title><link>https://info.linuxserver.io/issues/2024-03-21-endlessh/</link><pubDate>Thu, 21 Mar 2024 16:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2024-03-21-endlessh/</guid><category/><description>&lt;p>Due to a lack of upstream development, we have decided to deprecate our &lt;a href="https://github.com/linuxserver/docker-endlessh">endlessh&lt;/a> container.&lt;/p></description></item><item><title>Dillinger Deprecation Notice</title><link>https://info.linuxserver.io/issues/2024-03-20-dillinger/</link><pubDate>Wed, 20 Mar 2024 22:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2024-03-20-dillinger/</guid><category/><description>&lt;p>Due to a lack of upstream development, we have decided to deprecate our &lt;a href="https://github.com/linuxserver/docker-dillinger">dillinger&lt;/a> container.&lt;/p></description></item><item><title>New Container: Speedtest Tracker</title><link>https://info.linuxserver.io/issues/2024-02-10-speedtest-tracker/</link><pubDate>Sat, 10 Feb 2024 18:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2024-02-10-speedtest-tracker/</guid><category/><description>&lt;p>We have released a new container for &lt;a href="https://github.com/linuxserver/docker-speedtest-tracker/">Speedtest Tracker&lt;/a>!&lt;/p>
 &lt;p>&lt;a href="https://github.com/alexjustesen/speedtest-tracker">Speedtest Tracker&lt;/a> is a self-hosted internet performance tracking application that runs speedtest checks against Ookla&amp;rsquo;s Speedtest service.&lt;/p></description></item><item><title>New Container: Zotero</title><link>https://info.linuxserver.io/issues/2024-02-03-zotero/</link><pubDate>Sat, 03 Feb 2024 06:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2024-02-03-zotero/</guid><category/><description>&lt;p>We have released a new container for &lt;a href="https://github.com/linuxserver/docker-zotero/">Zotero&lt;/a>!&lt;/p>
 &lt;p>&lt;a href="https://www.zotero.org/">Zotero&lt;/a> is a free, easy-to-use tool to help you collect, organize, annotate, cite, and share research.&lt;/p></description></item><item><title>New Container: Shotcut</title><link>https://info.linuxserver.io/issues/2024-02-01-shotcut/</link><pubDate>Thu, 01 Feb 2024 06:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2024-02-01-shotcut/</guid><category/><description>&lt;p>We have released a new container for &lt;a href="https://github.com/linuxserver/docker-shotcut/">Shotcut&lt;/a>!&lt;/p>
 &lt;p>&lt;a href="https://www.shotcut.org/">Shotcut&lt;/a> is a free, open source, cross-platform video editor.&lt;/p></description></item><item><title>New Container: Monica</title><link>https://info.linuxserver.io/issues/2024-01-22-monica/</link><pubDate>Mon, 22 Jan 2024 18:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2024-01-22-monica/</guid><category/><description>&lt;p>We have released a new container for &lt;a href="https://github.com/linuxserver/docker-monica/">Monica&lt;/a>!&lt;/p>

issues/2024-03-29-cve-2024-3094/index.json

@@ -0,0 +1 @@
+{"is":"issue","title":"Regarding CVE-2024-3094 - Supply Chain Compromise Affecting XZ Utils","body":"\u003cp\u003eA supply chain compromise has been discovered in the XZ Utils data compression library, being tracked under \u003ca href=\"https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094\"\u003eCVE-2024-3094\u003c/a\u003e, which could allow remote code execution under certain circumstances. The original report is available \u003ca href=\"https://www.openwall.com/lists/oss-security/2024/03/29/4\"\u003ehere\u003c/a\u003e if you are interested in the technical details.\u003c/p\u003e\n\u003cp\u003eWe have evaluated all of our current base images for indications that they may be vulnerable to this exploit:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eOur Ubuntu, Debian, and Fedora base images are using older versions of XZ Utils which do not appear to contain the vulnerable code.\u003c/li\u003e\n\u003cli\u003eOur Arch base image did contain an affected version of XZ Utils, and we have now pushed an updated build that includes a fixed version of the XZ package.\u003c/li\u003e\n\u003cli\u003eOur Alpine Edge base image did contain an affected version of XZ Utils, but did not appear to be vulnerable due to the exploit\u0026rsquo;s dependency on glibc, and we have now pushed an updated build that includes a fixed version of the XZ package.\u003c/li\u003e\n\u003cli\u003eOur other Alpine base images are using older versions of XZ Utils which do not appear to contain the vulnerable code.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSo far the only exploitation path that has been observed is via SSH, and so in the vast majority of cases could not be exploited in any of our container environments, but we always recommend that you ensure any internet-facing containers are properly secured and kept up to date.\u003c/p\u003e\n\u003cp\u003eWe will update this post as and when more information becomes available.\u003c/p\u003e\n","createdAt":"2024-03-29 22:00:00 +0000 UTC","lastMod":"2024-03-29 20:30:57 +0000 UTC","permalink":"https://info.linuxserver.io/issues/2024-03-29-cve-2024-3094/","severity":"notice","resolved":false,"informational":false,"resolvedAt":"<no value>","affected":["Vulnerabilities"],"filename":"2024-03-29-cve-2024-3094.md"}

issues/index.xml

@@ -1,4 +1,15 @@
-<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><link rel="alternate" type="text/html" href="https://info.linuxserver.io"/><title>Issues on Info :: LinuxServer.io</title><link>https://info.linuxserver.io/issues/</link><description>History</description><generator>github.com/cstate</generator><language>en</language><lastBuildDate>2024-03-21T16:00:00+00:00</lastBuildDate><updated>2024-03-21T16:00:00+00:00</updated><atom:link href="https://info.linuxserver.io/issues/index.xml" rel="self" type="application/rss+xml"/><item><title>endlessh Deprecation Notice</title><link>https://info.linuxserver.io/issues/2024-03-21-endlessh/</link><pubDate>Thu, 21 Mar 2024 16:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2024-03-21-endlessh/</guid><category/><description>Due to a lack of upstream development, we have decided to deprecate our endlessh container.</description><content type="html">&lt;p>Due to a lack of upstream development, we have decided to deprecate our &lt;a href="https://github.com/linuxserver/docker-endlessh">endlessh&lt;/a> container.&lt;/p></content></item><item><title>Dillinger Deprecation Notice</title><link>https://info.linuxserver.io/issues/2024-03-20-dillinger/</link><pubDate>Wed, 20 Mar 2024 22:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2024-03-20-dillinger/</guid><category/><description>Due to a lack of upstream development, we have decided to deprecate our dillinger container.</description><content type="html">&lt;p>Due to a lack of upstream development, we have decided to deprecate our &lt;a href="https://github.com/linuxserver/docker-dillinger">dillinger&lt;/a> container.&lt;/p></content></item><item><title>New Container: Speedtest Tracker</title><link>https://info.linuxserver.io/issues/2024-02-10-speedtest-tracker/</link><pubDate>Sat, 10 Feb 2024 18:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2024-02-10-speedtest-tracker/</guid><category/><description>We have released a new container for Speedtest Tracker!
+<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><link rel="alternate" type="text/html" href="https://info.linuxserver.io"/><title>Issues on Info :: LinuxServer.io</title><link>https://info.linuxserver.io/issues/</link><description>History</description><generator>github.com/cstate</generator><language>en</language><lastBuildDate>2024-03-29T22:00:00+00:00</lastBuildDate><updated>2024-03-29T22:00:00+00:00</updated><atom:link href="https://info.linuxserver.io/issues/index.xml" rel="self" type="application/rss+xml"/><item><title>Regarding CVE-2024-3094 - Supply Chain Compromise Affecting XZ Utils</title><link>https://info.linuxserver.io/issues/2024-03-29-cve-2024-3094/</link><pubDate>Fri, 29 Mar 2024 22:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2024-03-29-cve-2024-3094/</guid><category/><description>A supply chain compromise has been discovered in the XZ Utils data compression library, being tracked under CVE-2024-3094, which could allow remote code execution under certain circumstances. The original report is available here if you are interested in the technical details.
+We have evaluated all of our current base images for indications that they may be vulnerable to this exploit:
+Our Ubuntu, Debian, and Fedora base images are using older versions of XZ Utils which do not appear to contain the vulnerable code.</description><content type="html">&lt;p>A supply chain compromise has been discovered in the XZ Utils data compression library, being tracked under &lt;a href="https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094">CVE-2024-3094&lt;/a>, which could allow remote code execution under certain circumstances. The original report is available &lt;a href="https://www.openwall.com/lists/oss-security/2024/03/29/4">here&lt;/a> if you are interested in the technical details.&lt;/p>
+&lt;p>We have evaluated all of our current base images for indications that they may be vulnerable to this exploit:&lt;/p>
+&lt;ul>
+&lt;li>Our Ubuntu, Debian, and Fedora base images are using older versions of XZ Utils which do not appear to contain the vulnerable code.&lt;/li>
+&lt;li>Our Arch base image did contain an affected version of XZ Utils, and we have now pushed an updated build that includes a fixed version of the XZ package.&lt;/li>
+&lt;li>Our Alpine Edge base image did contain an affected version of XZ Utils, but did not appear to be vulnerable due to the exploit&amp;rsquo;s dependency on glibc, and we have now pushed an updated build that includes a fixed version of the XZ package.&lt;/li>
+&lt;li>Our other Alpine base images are using older versions of XZ Utils which do not appear to contain the vulnerable code.&lt;/li>
+&lt;/ul>
+&lt;p>So far the only exploitation path that has been observed is via SSH, and so in the vast majority of cases could not be exploited in any of our container environments, but we always recommend that you ensure any internet-facing containers are properly secured and kept up to date.&lt;/p>
+&lt;p>We will update this post as and when more information becomes available.&lt;/p></content></item><item><title>endlessh Deprecation Notice</title><link>https://info.linuxserver.io/issues/2024-03-21-endlessh/</link><pubDate>Thu, 21 Mar 2024 16:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2024-03-21-endlessh/</guid><category/><description>Due to a lack of upstream development, we have decided to deprecate our endlessh container.</description><content type="html">&lt;p>Due to a lack of upstream development, we have decided to deprecate our &lt;a href="https://github.com/linuxserver/docker-endlessh">endlessh&lt;/a> container.&lt;/p></content></item><item><title>Dillinger Deprecation Notice</title><link>https://info.linuxserver.io/issues/2024-03-20-dillinger/</link><pubDate>Wed, 20 Mar 2024 22:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2024-03-20-dillinger/</guid><category/><description>Due to a lack of upstream development, we have decided to deprecate our dillinger container.</description><content type="html">&lt;p>Due to a lack of upstream development, we have decided to deprecate our &lt;a href="https://github.com/linuxserver/docker-dillinger">dillinger&lt;/a> container.&lt;/p></content></item><item><title>New Container: Speedtest Tracker</title><link>https://info.linuxserver.io/issues/2024-02-10-speedtest-tracker/</link><pubDate>Sat, 10 Feb 2024 18:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2024-02-10-speedtest-tracker/</guid><category/><description>We have released a new container for Speedtest Tracker!
 Speedtest Tracker is a self-hosted internet performance tracking application that runs speedtest checks against Ookla&amp;rsquo;s Speedtest service.</description><content type="html">&lt;p>We have released a new container for &lt;a href="https://github.com/linuxserver/docker-speedtest-tracker/">Speedtest Tracker&lt;/a>!&lt;/p>
 &lt;p>&lt;a href="https://github.com/alexjustesen/speedtest-tracker">Speedtest Tracker&lt;/a> is a self-hosted internet performance tracking application that runs speedtest checks against Ookla&amp;rsquo;s Speedtest service.&lt;/p></content></item><item><title>New Container: Zotero</title><link>https://info.linuxserver.io/issues/2024-02-03-zotero/</link><pubDate>Sat, 03 Feb 2024 06:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2024-02-03-zotero/</guid><category/><description>We have released a new container for Zotero!
 Zotero is a free, easy-to-use tool to help you collect, organize, annotate, cite, and share research.</description><content type="html">&lt;p>We have released a new container for &lt;a href="https://github.com/linuxserver/docker-zotero/">Zotero&lt;/a>!&lt;/p>