# Linode (Akamai): Open-source library XZ Utils Vulnerability (CVE-2024-3094)

> Linode (Akamai) status incident “Open-source library XZ Utils Vulnerability (CVE-2024-3094)” on 2024-04-01: impact none (vendor’s label), 0 min, 1 update(s). Archived by Rewindex.

Canonical: https://rewindex.com/company/linode-akamai/incidents/0yg19s5x1vyg
Last updated: 2024-04-01T21:37:00Z

- Impact (vendor’s label): none
- Status: resolved
- Started: 2024-04-01 21:37 UTC · Resolved: 2024-04-01 21:37 UTC · Duration: 0 min
- Updates: 1
- [Vendor status page: https://status.linode.com/incidents/0yg19s5x1vyg](https://status.linode.com/incidents/0yg19s5x1vyg)
- [Company: Linode (Akamai)](https://rewindex.com/company/linode-akamai.md)

## Timeline of updates

- **resolved** 2024-04-01 21:37 UTC: Akamai is aware of the reported supply chain compromise in the XZ Utils data compression library (CVE-2024-3094) which affects versions 5.6.0 and 5.6.1 of the xz-utils package. This vulnerability attempts to introduce the ability for an attacker to remotely execute commands in OpenSSH through the use of the liblzma library within some operating system environments. Akamai has assessed the vulnerability, and determined that the Akamai Platform is not affected and the Linux images currently offered by Linode are also not affected . However, customers who installed Kali Linux linodes between March 26 and March 29, or who switched to or upgraded their linodes to e.g., “unstable” or “testing” streams of certain Linux versions on their own may be affected. We strongly recommend that those customers follow the guidance of the OS provider to either patch or downgrade the affected packages as needed. To determine whether your system might be affected: Check the version of xz-utils and liblzma: xz --version In the output, make sure that the versions displayed are not 5.6.0 or 5.6.1. Verify that /usr/sbin/sshd is not linked against liblzma: ldd /usr/sbin/sshd \| grep liblzma If the output of this command is empty, then the system is not affected. If the output contains the pathname of the liblzma library, then the system may be affected depending on the version of liblzma/xz-utils as noted above. In addition, customers of Akamai Guardicore can utilize Akamai Guardicore Segmentation Insight to identify affected systems – see our detailed blog post for more details. For more information about this vulnerability, please see: https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094 https://www.openwall.com/lists/oss-security/2024/03/29/4 https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users https://lists.debian.org/debian-security-announce/2024/msg00057.html https://news.opensuse.org/2024/03/29/xz-backdoor/ https://www.kali.org/blog/about-the-xz-backdoor/ Thank you for your continued support.

_From the vendor’s published history: only the final update text is available for incidents before Rewindex began polling this page._

## Cite this

Status incident (vendor impact label: none) posted by Linode (Akamai), started 2024-04-01 21:37 UTC, resolved after 0 min, 1 update(s).

- Canonical URL: https://rewindex.com/company/linode-akamai/incidents/0yg19s5x1vyg
- Citation: Linode (Akamai), “Open-source library XZ Utils Vulnerability (CVE-2024-3094)” (2024-04-01 21:37 UTC). Archived by Rewindex: https://rewindex.com/company/linode-akamai/incidents/0yg19s5x1vyg (CC BY 4.0).
- Markdown link: `[Linode (Akamai): Open-source library XZ Utils Vulnerability (CVE-2024-3094) (2024-04-01)](https://rewindex.com/company/linode-akamai/incidents/0yg19s5x1vyg)`


---
Canonical: https://rewindex.com/company/linode-akamai/incidents/0yg19s5x1vyg · Markdown: https://rewindex.com/company/linode-akamai/incidents/0yg19s5x1vyg.md · JSON: https://rewindex.com/api/v1/companies/linode-akamai/incidents/0yg19s5x1vyg · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-04T14:50:38.626Z