🟠 High | Source: GCP Compute Engine Security Bulletins
GCP Compute Engine is not directly affected by CVE-2024-3094, a critical backdoor discovered in xz-utils versions 5.6.0 and 5.6.1 that could allow attackers to compromise OpenSSH. However, customers using custom VM images based on Fedora 41, Fedora Rawhide, Debian testing/unstable, or openSUSE Tumbleweed may still be at risk. Google’s public Compute Engine images are confirmed safe and require no action.
Security Architect’s Take: Audit any custom images deployed on Compute Engine to confirm they do not include xz-utils 5.6.0 or 5.6.1 — if they do, stop affected VMs immediately and rebuild images from a clean, patched base. Treat this as a supply-chain hygiene exercise and review your custom image build pipelines for dependency vetting controls.
Original advisory: GCP-2024-021