Backdoor in upstream xz/liblzma leading to SSH server compromise

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by keepamovin on Friday March 29, 2024 @12:55PM (#39866270)

If you installed xz on macOS using brew, then you have

  xz (XZ Utils) 5.6.1
  liblzma 5.6.1

which are within the release target for the vuln. As elsewhere in these comments, people say macOS effect is uncertain. If concerned you can revert to 5.4.6 with

  brew upgrade xz

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by pjl on Friday March 29, 2024 @02:20PM (#39867297)

Similarly if you're using MacPorts, make sure to sync and upgrade xz if you have it installed.

5.6.1 was available for a few days and just rolled back ~20 minutes ago: https://github.com/macports/macports-ports/commit/a1388aee09...

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by neodypsis on Friday March 29, 2024 @01:13PM (#39866495)

It's been reverted now: https://github.com/Homebrew/homebrew-core/blob/9a0603b474804...

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by keepamovin on Saturday March 30, 2024 @12:25AM (#39871827)

Yeah it was when I posted the comment too. That's why you could type brew upgrade xz and it went back to 5.4.6 I guess? But it might have been around that time, cutting it fine, not out for everybody. I don't know. Comment race condition haha! :)

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by quinncom on Saturday March 30, 2024 @12:15AM (#39871783)

[delayed]

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by keepamovin on Saturday March 30, 2024 @03:20AM (#39872607)

You're welcome!

[ Parent | on HN ]