[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 30 Mar 2024 20:53:22 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: backdoor in upstream xz/liblzma leading to ssh
server compromise
Hi,
On Sat, Mar 30, 2024 at 08:06:06PM +0100, Axel Beckert wrote:
> Hi,
>
> On Sat, Mar 30, 2024 at 07:00:42PM +0800, Alexander E. Patrakov wrote:
> > As GitHub has disabled the repository, the commit links in the
> > original message no longer work. One of the remaining mirrors is
> > https://git.rootprojects.org/root/xz
>
> Note that this is not a mirror of the adversary controlled git repo on
> Github but a mirror of https://git.tukaani.org/xz.git which is
> controlled by the original maintainer according to
> https://tukaani.org/xz-backdoor/. (And that repo is still there, too,
> even if it gives a 403 Forbidden when accessed with a web browser. You
> can still "git clone" from it.)
As a side note for an alternative: there is the Software Heritage
archive project which has as goal:
> The long term goal of the Software Heritage initiative is to collect
> all publicly available software in source code form together with its
> development history, replicate it massively to ensure its
> preservation, and share it with everyone who needs it. The Software
> Heritage archive is growing over time as we crawl new source code from
> software projects and development forges.
As such for the analysis it is possible to use as well
https://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://github.com/tukaani-project/xz
Regards,
Salvatore
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
