Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 22 Apr 2021 11:59:45 +0200
From: Peter Bex <peter@...e-magic.net>
To: oss-security@...ts.openwall.com
Subject: Re: Malicious commits to Linux kernel as part of
 university study

On Thu, Apr 22, 2021 at 11:44:49AM +0200, Albert Veli wrote:
> Supply chain attacks are a real threat to open source projects.

Absolutely, see also the recent malicious commits to the PHP project
which were injected through some security vulnerability in their git
server as just another example.

> The Linux kernel is not the easiest way to introduce malicious commits.
> But other projects like much used pip python modules, npm javascript
> modules and ruby gem modules might be less vetted before they accept
> commits and that is a serious risk.

Indeed.  My reason for posting was as a heads up to developers so they
can be extra vigilant for bad patches *from this particular group*.
But one should in general always be on the lookout, of course, because
commits might also just accidentally introduce security issues.

Cheers,
Peter

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.