News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise. Parent comment

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by pja on Friday March 29, 2024 @01:59PM (#39867077)
This account changed the instructions for reporting security issues in the xz github as their very last commit:

    commit af071ef7702debef4f1d324616a0137a5001c14c (HEAD -> master, origin/master, origin/HEAD)
    Author: Jia Tan <[email protected]>
    Date:   Tue Mar 26 01:50:02 2024 +0800

        Docs: Simplify SECURITY.md.

    diff --git a/.github/SECURITY.md b/.github/SECURITY.md
    index e9b3458a..9ddfe8e9 100644
    --- a/.github/SECURITY.md
    +++ b/.github/SECURITY.md
    @@ -16,13 +16,7 @@ the chance that the exploit will be used before a patch is released.
     You may submit a report by emailing us at
     [[email protected]](mailto:[email protected]), or through
     [Security Advisories](https://github.com/tukaani-project/xz/security/advisories/new).
    -While both options are available, we prefer email. In any case, please
    -provide a clear description of the vulnerability including:
    -
    -- Affected versions of XZ Utils
    -- Estimated severity (low, moderate, high, critical)
    -- Steps to recreate the vulnerability
    -- All relevant files (core dumps, build logs, input files, etc.)
    +While both options are available, we prefer email.

     This project is maintained by a team of volunteers on a reasonable-effort
     basis. As such, please give us 90 days to work on a fix before
Seems innocuous, but maybe they were planning further changes.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by bombcar on Friday March 29, 2024 @02:18PM (#39867271)
> Seems innocuous, but maybe they were planning further changes.

Seems like an attempt to get 90 days of "use" of this vulnerability after discovery. If they only had checked performance before!

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by hackernudes on Friday March 29, 2024 @03:18PM (#39867916)
No, they just removed the bullet points about what to include in a report. The 90 days part was in both versions.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by bombcar on Friday March 29, 2024 @03:23PM (#39867965)
True, but the "talk only to me" part was new, I think.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by hughesjj on Tuesday April 02, 2024 @05:28AM (#39903806)
They didn't add any content, it was a pure removal commit
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by meragrin_ on Friday March 29, 2024 @05:12PM (#39869081)
Yes. An incomplete report allows for dragging out "fixing" the issue longer.
[ Parent | on HN ]