CVE-2024-3094 - AutomataCI Countermeasures

[corygalyna]

@hollowaykeanho ?

[hollowaykeanho]

I just completed the routine check.

1. Homebrew - already downgraded (https://github.com/orgs/Homebrew/discussions/5243)
2. Debian - stable branch not affected (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024)
3. Chocolatey - unknown

Right now, Chocolatey is the one I'm suprebly worried at most due to their lack of emphasis and facility with securing origin.

[corygalyna]

Any chance to find out Chocolatey?

[corygalyna]

Also, is AutomataCI affected?

[hollowaykeanho]

is AutomataCI affected?

No. AutomataCI is entirely built using shell scripts. It should not be an earthquake.

Any chance to find out Chocolatey?

I have no idea. Still searching.

[corygalyna]

That bad?

[hollowaykeanho]

You have no idea. I'm likely going to perform direct vendor sourcing for both Homebrew and Chocolatey in the future to remove 1 layer of supply chain.

Chocolatey will be my first target. Their community packages are horrible.

[corygalyna]

So generally, AutomataCI users are safe right?

[hollowaykeanho]

As long as xz and its deployment are NOT side loaded (homebrew & chocolatey) and patched with the latest releases, they're fine and they just have follow their ecosystems' upstream instructions to mitigate the matter.