KB-2300 Information about the XZ Utils Data Compression Library Vulnerability (CVE-2024-3094)

On 29-Mar-2024, a Microsoft security researcher announced that he had discovered malicious code in the upstream tarballs of xz, a lossless data compression library, starting with version 5.6.0. Shortly thereafter, NVD assigned the backdoor vulnerability a CVE, and CISA recommended all affected users downgrade to an uncompromised version.

Upon assessing the Appian platform against all details of the CVE, we can confirm that the Appian platform is not impacted by this vulnerability as Appian does not utilize the impacted versions described in the above advisories. We will continue to monitor the situation and provide any updates as appropriate.

Additional Notes:

The following CVE was released with additional information on the scope of the vulnerability:

• CVE-2024-3094 (“XZ: Malicious Code in Distributed Source”)

Supporting Documentation:

• https://www.openwall.com/lists/oss-security/2024/03/29/4
  
• https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094
  

Affected Versions

This article applies to all supported versions of Appian.

Last reviewed: April 5, 2024