Latest Ubuntu beta and other Linux distros delayed by xz-utils security issues

(Image credit: Future)

The beta version of Ubuntu 24.04 won’t be released on time, the developers have confirmed, following concerns about a major security threat.

Instead of launching on April 4, the latest Ubuntu version, which also holds the codename Noble Numbat, will now be released on April 11 after developers Canonical decided to push the release for a week because of the discovery of CVE-2024-3094, a critical vulnerability recently discovered in xz-utils.

XZ-utils is a set of data compression tools and libraries used by major Linux distros. The vulnerability was introduced to XZ version 5.6.0 by a pseudonymous attacker, and persisted throughout 5.6.1 as well.

Securing future versions

The majority of Linux distros seem to be affected by the flaw. Ubuntu 24.04 (but not older versions), Red Hat, Fedora Rawhide, and Fedora 40, as well as some Kali Linux versions, and some Arch Linux installation media, are affected.

Red Hat Enterprise Linux (RHEL) versions, stable Debian releases, as well as Linux Mint, Gentoo Linux, Alpine Linux and Amazon Linux are not affected, it was said.

In the Discourse post, Canonical said it will “remove and rebuild all binary packages that had been built for Noble Numbat after the CVE-2024-3094 code was committed to xz-utils (February 26th), on newly provisioned build environments." This should make the latest Ubuntu release safe from the vulnerability which was given a severity score of 10.0.

Tom’s Hardware speculates that the launch of the final 24.04 version - planned for April 25 - could also be delayed. A survey on Mastodon, set up by a former Canonical employee, showed that out of roughly 100 respondents, only a slim majority (56% versus 44%) expects the version to be released on time.

Earlier this week, Binarly released a free scanner to make hunting for the flaw faster, more seamless, and with fewer false positives.

More from TechRadar Pro

Huge backdoor discovered that could compromise SSH logins on Linux
Here's a list of the best firewalls around today
These are the best endpoint security tools right now

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.