Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 29 Mar 2024 20:32:42 +0100
From: Vegard Nossum <>
To:, Ivan Delalande <>,
        Andres Freund <>,
        Andrew Morton <>
Subject: Re: backdoor in upstream xz/liblzma leading to ssh
 server compromise

On 29/03/2024 19:54, Ivan Delalande wrote:
> On Fri, Mar 29, 2024 at 08:51:26AM -0700, Andres Freund wrote:
>> For which the exploit code was then adjusted:
>> Given the activity over several weeks, the committer is either directly
>> involved or there was some quite severe compromise of their
>> system. Unfortunately the latter looks like the less likely explanation, given
>> they communicated on various lists about the "fixes" mentioned above.
> Knowing this, I hope the recent kernel patch series involving the same
> person to some degree will get extra scrutiny:

I *think* this patch series is safe and was just pushed to make more
people upgrade to newer versions faster (you'll notice the BCJ filters
are Co-developed-by: Jia -- not implying that Lasse was acting in bad
faith here).

Of course it still deserves more scrutiny...


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.