Any relation between tukaani.xz.jar and the recent xz-utils CVE?

[Bananeweizen]

There is currently a CVE about a backdoor in xz-utils being discussed all over the net:
https://tukaani.org/xz-backdoor/
https://www.openwall.com/lists/oss-security/2024/03/29/4
https://bsky.app/profile/did:plc:x2nsupeeo52oznrmplwapppl/post/3kowjkx2njy2b

The jgit project uses a Java library tukaani.xz in version 1.9: https://github.com/eclipse-jgit/jgit/blob/master/org.eclipse.jgit.packaging/org.eclipse.jgit.target/maven/dependencies.tpd#L264 (committers will probably also be able to point to the bazel dependency for this).

Can someone please explain whether there is any relation between the Java library and the above mentioned CVE relevant libraries? From previous experience with log4shell I know that companies often fail to clearly separate between affected and not affected components by just scanning for anything that matches a keyword like "tukaani AND xz", so it might be good to clearly tell the world in advance that this project is not(?) affected.

[msohn]

JGit uses org.tukaani:xz:1.9 which is the latest release of xz-java.

• source code of xz-java is hosted at https://git.tukaani.org/?p=xz-java.git;a=summary
• maven dependency: https://github.com/eclipse-jgit/jgit/blob/master/pom.xml#L892
• osgi dependency: https://github.com/eclipse-jgit/jgit/blob/master/org.eclipse.jgit.packaging/org.eclipse.jgit.target/maven/dependencies.tpd#L264
• bazel dependency: https://github.com/eclipse-jgit/jgit/blob/master/WORKSPACE#L163
• org.tukaani:xz:1.9 is downloaded from Maven Central where it's hosted at https://repo1.maven.org/maven2/org/tukaani/xz/1.9

CVE-2024-3094 has been reported for releases 5.6.0 and 5.6.1 of the C implementation of xz.

I checked the history of xz-java source code for commits from Jia Tan and found the following 4 commits:
$ git lo --author [email protected]

• 171b362 - Update README for bug report email address and IRC channel server. (2 months ago)
• 67d9763 - Update docs and metadata for new project website. (2 months ago)
• 8e46fdf - Implements ARM64 filter described in xz spec version 1.1.0. (1 year, 3 months ago)
• 52fcb4a - Removes unused imports flagged by text editor. (1 year, 4 months ago)

The only commit containing non-trivial code changes is 8e46fdf and looks ok. JGit does not use any of the classes in this commit.

Hence I conclude that JGit is not affected by CVE-2024-3094.

[Bananeweizen]

Thanks a lot for that thorough analysis and explanation, Matthias. That's very much appreciated.