DOCKER HUB STILL HOSTS DOZENS OF LINUX IMAGES WITH THE XZ BACKDOOR

Summary from the TLDR InfoSec newsletter

There are over 35 Docker Hub images that still contain the XZ-Utils backdoor (CVE-2024-3094). Discovered in March 2024, the vulnerability allows attackers with a specific private key to bypass SSH authentication and execute commands as root. Debian has refused to remove the backdoored images, citing low exploitation risk and archival continuity, despite the danger of accidental pulls in CI/CD pipelines. Organizations should verify that their containers use XZ-Utils version 5.6.2 or later to avoid inheriting this supply chain compromise.