Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 30 Mar 2024 20:06:06 +0100
From: Axel Beckert <>
Subject: Re: backdoor in upstream xz/liblzma leading to ssh
 server compromise


On Sat, Mar 30, 2024 at 07:00:42PM +0800, Alexander E. Patrakov wrote:
> As GitHub has disabled the repository, the commit links in the
> original message no longer work. One of the remaining mirrors is

Note that this is not a mirror of the adversary controlled git repo on
Github but a mirror of which is
controlled by the original maintainer according to (And that repo is still there, too,
even if it gives a 403 Forbidden when accessed with a web browser. You
can still "git clone" from it.)

BTW, both repos miss that most recent commit on Github by the adversary
with the now infamous "simplification of".

		Kind regards, Axel
PGP: 2FF9CD59612616B5      /~\  Plain Text Ribbon Campaign,
Mail:  \ /  Say No to HTML in E-Mail and Usenet
Mail+Jabber:  X   / \  I love long mails:

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.