Important information regarding xz-utils (CVE-2024-3094)

This post details GitLab's response to CVE-2024-3094, a supply chain vulnerability in xz-utils. It confirms that GitLab.com and GitLab Dedicated are not affected by the vulnerable versions (5.6.0 and 5.6.1). It advises self-hosted customers to check their local packages, suggests downgrading to 5.4.x if affected, and recommends bringing potentially compromised hosts and containers offline. It also notes GitHub's action to disable the affected repository.