[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20240329170729.27sconsbpz55xo47@awork3.anarazel.de>
Date: Fri, 29 Mar 2024 10:07:29 -0700
From: Andres Freund <andres@...razel.de>
To: oss-security@...ts.openwall.com
Cc: Alex Gaynor <alex.gaynor@...il.com>
Subject: Re: backdoor in upstream xz/liblzma leading to ssh server compromise
Hi Alex,
(I was not subscribed to oss-security and not CCed, so I only got your email
from the archive, not sure if I got the In-Reply-To etc right. Subscribed
now.)
> Thanks for writing this up. Just to make sure I understand the action
> item here: folks who are building their own xz, should switch to a
> release prior to 5.6.0, as those are the only ones known to be
> unaffected?
If you are building your own xz you might not be affected, due to either the
debian/ directory needing to exist, or $RPM_ARCH needing to be
set. Furthermore, if you build from git, rather than the distributed tarballs,
the backdoor code won't be injected into the build, even if present in the
repository. Similar if you build with cmake, I think.
However, I personally would still downgrade, even if likely not affected due
to the above.
Greetings,
Andres Freund
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
