Dom0 has xz-5.4.1, which doesn't include that backdoor. Neither Fedora 39 nor Debian 12 are affected.

Originally posted by @marmarek in #9067 (comment)

xz-5.4.1 was released by the very same person who inserted the backdoor into 5.6.0/5.6.1:
https://github.com/tukaani-project/xz/tree/v5.4.1

We should look at libarchive too; vulnerabilities are now known to have been inserted by the same person who backdoored xz:
libarchive/libarchive#1609

A good timeline is still being created here:
https://boehs.org/node/everything-i-know-about-the-xz-backdoor

We may wish to consider the use of zstd instead:
https://github.com/facebook/zstd