News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise. Parent comment

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by buildbot on Friday March 29, 2024 @01:38PM (#39866839)
If libarchive is also backdoored, would that allow specifically crafted http gzip encoded responses to do bad things?
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by nicolas_17 on Friday March 29, 2024 @02:03PM (#39867117)
What software is using libarchive to decode HTTP responses?
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by buildbot on Friday March 29, 2024 @02:10PM (#39867189)
I don't know, way outside my domain. Possibly none I guess?
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by giantrobot on Friday March 29, 2024 @05:45PM (#39869354)
FreeBSD's archive tools are built on top of libarchive IIRC. Not sure about the other BSDs.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by mattbee on Friday March 29, 2024 @07:14PM (#39870084)
Well for one, the Powershell script I just wrote to build all the 3rd-party library dependencies for a video game.

tar.exe was added to Windows this January, sourced from libarchive: https://learn.microsoft.com/en-us/virtualization/community/t...

Unlike the GNU tar I'm used to, it's actually a "full fat" command line archiving tool, compressing & decompressing zip, xz, bz2 on the command-line - really handy :-O

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by duskwuff on Friday March 29, 2024 @04:55PM (#39868901)
No. There's no good reason HTTP response decoding would ever be implemented in terms of libarchive; using libz directly is simpler and supports some use cases (like streaming reads) which libarchive doesn't.
[ Parent | on HN ]