# CVE-2024-3094: Malicious code in xz 5.6.0 and 5.6.1 tarballs

**URL:** https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405
**Category:** Security
**Created:** [March 29, 2024, 8:39pm UTC](https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405 "2024-03-29T20:39:48Z")
**Posts on this page:** 1
**Showing post:** 34

<div class="post-metadata">

### Author: ![norpol](https://discourse.nixos.org/user_avatar/discourse.nixos.org/norpol/32/8764_2.png) [@norpol](https://discourse.nixos.org/u/norpol)
#### Post date: [March 30, 2024, 5:06pm UTC](https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405/34 "2024-03-30T17:06:27Z")

</div>

From the original report, the payload was only included when this if case triggered during build. `if test -f "$srcdir/debian/rules" || test "x$RPM_ARCH" = "xx86_64";then`. As Nix builds are pure, aka won’t contain `debian/rules` or the variable `RPM_ARCH` during build, there shouldn’t be any official nix generated artifact that will contain the payload built in.

---

_[View the full topic](https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405)._