XZ Utils / CVE-2024-3094
Cronologia e supply-chain path basati su NVD e documentazione ufficiale Red Hat.
REAL SOFTWARE SUPPLY-CHAIN CASE
XZ Utils / CVE-2024-3094
Come collegare tarball, build process, liblzma e software dipendente senza oltrepassare le fonti?
STATUSINTERACTIVE DEMONSTRATIONLAST UPDATE / 2026-07-25
WHAT THE SOURCES SAY
- CVE-2024-3094 was published on 29 March 2024.
- Malicious code was present in upstream tarballs starting with 5.6.0.
- The build process affected liblzma.
- Red Hat issued defensive guidance.
WHAT ARGUS7 ADDS
- Source chronology
- Supply-chain entity graph
- Version normalization
- Evidence-linked path
- Exposure hypothesis
- Human-reviewed finding
01INPUT→
02SOURCE→
03RAW DATA→
04NORMALIZATION→
05MODULE ROUTING→
06MODULE ANALYSIS→
07ENTITY GRAPH→
08EVIDENCE→
09CORRELATION→
10HYPOTHESIS→
11HUMAN REVIEW→
12FINDING→
13REPORT
Dati tecnici pubblici da NVD e Red Hat. La visualizzazione ARGUS7 è dimostrativa e non contiene istruzioni operative per l’abuso della vulnerabilità.