KB-2300 Information about the XZ Utils Data Compression Library Vulnerability (CVE-2024-3094)

pauline.delacruz — Fri, 05 Apr 2024 19:51:32 GMT

Current Revision posted to Appian Knowledge Base by pauline.delacruz on 4/5/2024 7:51:32 PM

On 29-Mar-2024, a Microsoft security researcher announced that he had discovered malicious code in the upstream tarballs of xz, a lossless data compression library, starting with version 5.6.0. Shortly thereafter, NVD assigned the backdoor vulnerability a CVE, and CISA recommended all affected users downgrade to an uncompromised version.

Upon assessing the Appian platform against all details of the CVE, we can confirm that the Appian platform is not impacted by this vulnerability as Appian does not utilize the impacted versions described in the above advisories. We will continue to monitor the situation and provide any updates as appropriate.

Additional Notes:

The following CVE was released with additional information on the scope of the vulnerability:

CVE-2024-3094 (“XZ: Malicious Code in Distributed Source”)

Supporting Documentation:

Affected Versions

This article applies to all supported versions of Appian.

Last reviewed: April 5, 2024

Tags: Security

KB-2300 Information about the XZ Utils Data Compression Library Vulnerability (CVE-2024-3094)

pauline.delacruz — Fri, 05 Apr 2024 19:50:17 GMT

Revision 2 posted to Appian Knowledge Base by pauline.delacruz on 4/5/2024 7:50:17 PM

Additional Notes:

The following CVE was released with additional information on the scope of the vulnerability:

CVE-2024-3094 (“XZ: Malicious Code in Distributed Source”)

Supporting Documentation:

Affected Versions

This article applies to all supported versions of Appian.

Last reviewed: April 2024

KB-2300 Information about the XZ Utils Data Compression Library Vulnerability (CVE-2024-3094)

pauline.delacruz — Fri, 05 Apr 2024 19:48:23 GMT

Revision 1 posted to Appian Knowledge Base by pauline.delacruz on 4/5/2024 7:48:23 PM

Additional Notes:

The following CVE was released with additional information on the scope of the vulnerability:

CVE-2024-3094 (“XZ: Malicious Code in Distributed Source”)

Supporting Documentation:
https://www.openwall.com/lists/oss-security/2024/03/29/4
https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094

Affected Versions

This article applies to all supported versions of Appian.

Last reviewed: April 2024