From 0aa828402d344ff93f26c270fed032febbe71474 Mon Sep 17 00:00:00 2001
From: "Rick Farina (Zero_Chaos)" <zerochaos@gentoo.org>
Date: Fri, 29 Mar 2024 21:28:30 -0400
Subject: [PATCH] profile: mask for the xz backdoor

---
 profiles/pentoo/base/package.mask | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/profiles/pentoo/base/package.mask b/profiles/pentoo/base/package.mask
index 53bc4baea..3adce87a3 100644
--- a/profiles/pentoo/base/package.mask
+++ b/profiles/pentoo/base/package.mask
@@ -185,3 +185,9 @@ dev-lang/lua:0
 
 # Force upgrade of protobuf
 #<dev-libs/protobuf-21.12
+
+#CVE 2024-3094
+#While the CVE doesn't affect gentoo, trust level is extremely low.
+#Masking the known affected versions, may expand as information becomes available.
+~app-arch/xz-utils-5.6.0
+~app-arch/xz-utils-5.6.1