oss-security - Re: backdoor in upstream xz/liblzma leading to ssh server compromise

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 29 Mar 2024 13:10:40 -0400
From: Alex Gaynor <alex.gaynor@...il.com>
To: Andres Freund <andres@...razel.de>
Cc: oss-security@...ts.openwall.com
Subject: Re: backdoor in upstream xz/liblzma leading to ssh server compromise

On Fri, Mar 29, 2024 at 1:07 PM Andres Freund <andres@...razel.de> wrote:
>
> Hi Alex,
>
> (I was not subscribed to oss-security and not CCed, so I only got your email
> from the archive, not sure if I got the In-Reply-To etc right. Subscribed
> now.)

Your email came through.

>
> > Thanks for writing this up. Just to make sure I understand the action
> > item here: folks who are building their own xz, should switch to a
> > release prior to 5.6.0, as those are the only ones known to be
> > unaffected?
>
> If you are building your own xz you might not be affected, due to either the
> debian/ directory needing to exist, or $RPM_ARCH needing to be
> set. Furthermore, if you build from git, rather than the distributed tarballs,
> the backdoor code won't be injected into the build, even if present in the
> repository. Similar if you build with cmake, I think.
>
> However, I personally would still downgrade, even if likely not affected due
> to the above.
>
> Greetings,
>
> Andres Freund

Thanks for confirming, and indeed I'm taking a better safe than sorry approach.

Alex

-- 
All that is necessary for evil to succeed is for good people to do nothing.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.