They noticed that some ssh sessions took 0.5 seconds too long under certain circumstances. 😲

Holy hell that's good QA.

Damn, it is actually scary that they managed to pull this off. The backdoor came from the second-largest contributor to xz too, not some random drive-by.

This is a fun one we're gonna be hearing about for a while...

It's fortunate it was discovered before any major releases of non-rolling-release distros were cut, but damn.

This is the best post I've read about it so far: https://boehs.org/node/everything-i-know-about-the-xz-backdoor

If you're using xz version 5.6.0 or 5.6.1, please upgrade asap, especially if you're using a rolling-release distro like Arch or its derivatives. Arch has rolled out the patched version a few hours ago.

The person who found the backdoor : https://mastodon.social/@AndresFreundTec/112180083704606941

Time to bring back the reproducible build hype

Reading the comments here https://news.ycombinator.com/item?id=39865810 it appears that libarchive may be tainted as well.

This is pretty insane. Can't wait for the Darknet Diaries on this one.

ELI5 what does this mean for the average Linux user? I run a few Ubuntu 22.04 systems (yeah yeah, I know, canonical schmanonical) - but they aren’t bleeding edge, so they shouldn’t exhibit this vulnerability, right?

Lzma balls

Here is the official statement from OpenSUSE: https://news.opensuse.org/2024/03/29/xz-backdoor/

t y for sharing.

#showerthoughts The problem is in upstream and has only entered Debian Sid/unstable. Does this mean that for example bleeding edge Arch (btw) sshd users are compromised already ?

This also affects Fedora 40 and Fedora Rawhide - https://discussion.fedoraproject.org/t/warning-malicious-code-in-current-pre-release-testing-versions-variants-f40-and-rawhide-affected-users-of-f40-rawhide-need-to-respond/110683

Damn fine work all around.

I know this is an issue fraught with potential legal and political BS, and it's impossible to check everything without automation these days, but is there an organization that trains and pays people to work as security researchers or QA for open source projects?

Basically, a watchdog group that finds exploitable security vulnerabilities, and works with individuals or vendors to patch them? Maybe make it a publicly owned and operated group with mandatory reporting of some kind. An international project funded by multiple governments, where it's harder for a single point of influence to hide exploits, abuse secrets, or interfere with the researchers? They don't own or control any code, just find security issues and advise.

I don't know.

Just thinking that modern security is getting pretty complicated, with so many moving parts and all.

It seems like a RCE, rather an auth bypass once though. https://bsky.app/profile/filippo.abyssdomain.expert/post/3kowjkx2njy2b

And you know what? Doing updates once a week saved me from updating to this version :)