What is CVE-2024-3094?

CVE-2024-3094 is a security advisory published by Palo Alto Networks Security Advisories. CVE-2024-3094 Informational: Impact of Malicious Code in XZ Tools and Libraries (CVE-2024-3094)

Which CVE IDs does CVE-2024-3094 cover?

CVE-2024-3094 covers the following CVE IDs: CVE-2024-3094. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by CVE-2024-3094?

CVE-2024-3094 affects 8 products, including: PAN-OS; GlobalProtect App; Prisma Cloud Compute; Prisma Cloud; Cloud NGFW; and others — see the full list on the advisory page.

CVE-2024-3094

CVE-2024-3094 Informational: Impact of Malicious Code in XZ Tools and Libraries (CVE-2024-3094)

Vendor

Palo Alto Networks Security Advisories

Published

April 1, 2024

Last Modified

April 1, 2024

🔗 CVE IDs covered (1)

CVE-2024-3094 →

📋 Description

The Palo Alto Networks Product Security Assurance team has evaluated the supply chain compromise impacting versions 5.6.0 and 5.6.1 of XZ tools and libraries. These versions of the software may allow unauthorized access to affected systems. Based on the information presently known, Palo Alto Networks products and cloud services do not contain affected XZ software packages and are not impacted by these issues. Please refer to the Unit42 Threat Brief for the latest guidance and product offerings to protect customers from CVE-2024-3094 in their environments: https://unit42.paloaltonetworks.com/threat-brief-xz-utils-cve-2024-3094/

🎯 Affected products8

PAN-OS
GlobalProtect App
Prisma Cloud Compute
Prisma Cloud
Cloud NGFW
Prisma Access
Cortex XDR
Cortex XDR Agent

✅ Remediation

No software updates are required at this time.

🔗 References (1)

advisoryhttps://security.paloaltonetworks.com/CVE-2024-3094