# Elastic Security Statement for CVE-2024-3094, xz versions 5.6.0 and 5.6.1 **URL:** \ **Category:** Security Announcements\ **Created:** [April 22, 2024, 9:19am UTC](https://discuss.elastic.co/t/elastic-security-statement-for-cve-2024-3094-xz-versions-5-6-0-and-5-6-1/357894 "2024-04-22T09:19:38Z")\ **Posts on this page:** 1\ **Showing post:** 1
**Author:** ![ismisepaul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismisepaul/32/102235_2.png) [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Post date:** [April 22, 2024, 9:19am UTC](https://discuss.elastic.co/t/elastic-security-statement-for-cve-2024-3094-xz-versions-5-6-0-and-5-6-1/357894/1 "2024-04-22T09:19:38Z")
**Elastic Products are not affected by this issue.** On March 29th, 2024, Elastic became aware of the [malicious code planted in the xz package](https://www.elastic.co/security-labs/500ms-to-midnight). Elastic has performed an investigation to identify any Elastic Products which may be impacted by this issue and we have concluded that no Elastic products use the versions of xz affected by this vulnerability. Therefore, Elastic Products are not affected by this issue. Reference Links: - [oss-security - backdoor in upstream xz/liblzma leading to ssh server compromise](https://www.openwall.com/lists/oss-security/2024/03/29/4) - [500ms to midnight: XZ / liblzma backdoor — Elastic Security Labs](https://www.elastic.co/security-labs/500ms-to-midnight) - [Urgent security alert for Fedora 41 and Fedora Rawhide users](https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users) - [[SECURITY] [DSA 5649-1] xz-utils security update](https://lists.debian.org/debian-security-announce/2024/msg00057.html) - [NVD - CVE-2024-3094](https://nvd.nist.gov/vuln/detail/CVE-2024-3094) --- _[View the full topic](https://discuss.elastic.co/t/elastic-security-statement-for-cve-2024-3094-xz-versions-5-6-0-and-5-6-1/357894)._