520
backdoor in upstream xz/liblzma leading to ssh server compromise (www.openwall.com)
submitted 2 years ago by to c/linux@lemmy.ml
96 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 13 points 2 years ago*

Arch had a patch rolled out yesterday [1][2][3] that switches to the git repo. On top of that the logic in the runtime shim and build script modifier was orchestrated to target Debian and RPM build systems and environments [4].

[1] https://gitlab.archlinux.org/archlinux/packaging/packages/xz/-/commit/881385757abdc39d3cfea1c3e34ec09f637424ad

[2] https://gitlab.archlinux.org/archlinux/packaging/packages/xz/-/issues/2

[3] https://security.archlinux.org/CVE-2024-3094

[4] https://www.openwall.com/lists/oss-security/2024/03/29/4

  • permalink
  • fedilink
  • source
  • parent