Latest Ubuntu beta and other Linux distros delayed by xz-utils security issues
The beta version of Ubuntu 24.04 won’t be released on time, the developers have confirmed, following concerns about a major security threat.
Instead of launching on April 4, the latest Ubuntu version, which also holds the codename Noble Numbat, will now be released on April 11 after developers Canonical decided to push the release for a week because of the discovery of CVE-2024-3094, a critical vulnerability recently discovered in xz-utils.
XZ-utils is a set of data compression tools and libraries used by major Linux distros. The vulnerability was introduced to XZ version 5.6.0 by a pseudonymous attacker, and persisted throughout 5.6.1 as well.
Securing future versions
The majority of Linux distros seem to be affected by the flaw. Ubuntu 24.04 (but not older versions), Red Hat, Fedora Rawhide, and Fedora 40, as well as some Kali Linux versions, and some Arch Linux installation media, are affected.
Red Hat Enterprise Linux (RHEL) versions, stable Debian releases, as well as Linux Mint, Gentoo Linux, Alpine Linux and Amazon Linux are not affected, it was said.
In the Discourse post, Canonical said it will “remove and rebuild all binary packages that had been built for Noble Numbat after the CVE-2024-3094 code was committed to xz-utils (February 26th), on newly provisioned build environments.” This should make the latest Ubuntu release safe from the vulnerability which was given a severity score of 10.0.
Tom’s Hardware speculates that the launch of the final 24.04 version – planned for April 25 – could also be delayed. A survey on Mastodon, set up by a former Canonical employee, showed that out of roughly 100 respondents, only a slim majority (56% versus 44%) expects the version to be released on time.
Earlier this week, Binarly released a free scanner to make hunting for the flaw faster, more seamless, and with fewer false positives.
