Detections
Analytics
Alpine: multiple lighttpd packages: security update to 1.4.76-r0
critical Tenable Cloud Security Plugin ID 425706
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a
series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised
test file existing in the source code, which is then used to modify specific functions in the liblzma
code. This results in a modified liblzma library that can be used by any software linked against this
library, intercepting and modifying the data interaction with this library. (CVE-2024-3094)
See Also
Plugin Details
Severity: Critical
ID: 425706
Version: Revision 1.4
Type: Local
Published: 4/18/2025
Updated: 7/6/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Critical
Score: 9.7
Percentile: 99.97
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2024-3094
CVSS v3
Risk Factor: Critical
Base Score: 10
Temporal Score: 9.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 3/29/2024
Reference Information
CVE: CVE-2024-3094