Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 29 Mar 2024 10:07:29 -0700
From: Andres Freund <>
Cc: Alex Gaynor <>
Subject: Re: backdoor in upstream xz/liblzma leading to ssh server compromise

Hi Alex,

(I was not subscribed to oss-security and not CCed, so I only got your email
from the archive, not sure if I got the In-Reply-To etc right. Subscribed

> Thanks for writing this up. Just to make sure I understand the action
> item here: folks who are building their own xz, should switch to a
> release prior to 5.6.0, as those are the only ones known to be
> unaffected?

If you are building your own xz you might not be affected, due to either the
debian/ directory needing to exist, or $RPM_ARCH needing to be
set. Furthermore, if you build from git, rather than the distributed tarballs,
the backdoor code won't be injected into the build, even if present in the
repository. Similar if you build with cmake, I think.

However, I personally would still downgrade, even if likely not affected due
to the above.


Andres Freund

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.