News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise. Parent comment

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by formerly_proven on Friday March 29, 2024 @01:15PM (#39866509)
Well that account also did most of the releases since 5.4.0.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by alwaysbeconsing on Friday March 29, 2024 @02:31PM (#39867431)
+1 Can see from project homepage http://web.archive.org/web/20240329165859/https://xz.tukaani... they have some release responsibility from 5.2.12.

> Versions 5.2.12, 5.4.3 and later have been signed with Jia Tan's OpenPGP key . The older releases have been signed with Lasse Collin's OpenPGP key .

It must be assume that before acquiring that privilege, they also contributed code to project. Probably most was to establish respectable record. Still could be malicious code going back someways.

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by 0x0 on Friday March 29, 2024 @07:28PM (#39870187)
Looks like the Jia Tan OpenPGP key was replaced a few months ago as well: https://github.com/tukaani-project/tukaani-project.github.io...
[ Parent | on HN ]