News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise. Parent comment

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by smeehee on Friday March 29, 2024 @03:10PM (#39867822)
Debian have reverted xz-utils (in unstable) to 5.4.5 – actual version string is “5.6.1+really5.4.5-1”. So presumably that version's safe; we shall see…
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by xorcist on Friday March 29, 2024 @09:04PM (#39870831)
Is that version truly vetted? "Jia Tan" has been the official maintainer since 5.4.3, could have pushed code under any other pseudonym, and controls the signing keys. I would have felt better about reverting farther back, xz hasn't had any breaking changes for a long time.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by rnmkr on Friday March 29, 2024 @09:18PM (#39870915)
It's not only that account, other maintainer has been pushing the same promotion all over the place.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by tobias2014 on Friday March 29, 2024 @09:28PM (#39870975)
It looks like this is being discussed, with a complication of additional symbols that were introduced https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by binkHN on Saturday March 30, 2024 @12:28AM (#39871835)
Thanks for this! I found this URL in the thread very interesting!

https://www.nongnu.org/lzip/xz_inadequate.html

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by mehdix on Saturday March 30, 2024 @02:14AM (#39872305)
It is an excellent technical write-up and yet again another testimonial to the importance of keeping things simple.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by userbinator on Saturday March 30, 2024 @03:54AM (#39872772)
The other comments here showing that the backdoor was a long-term effort now make me wonder just how long of an effort it was...
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by kzrdude on Saturday March 30, 2024 @04:21AM (#39872902)
There are suggestions to roll back further
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by sgarland on Saturday March 30, 2024 @09:42AM (#39874798)
TIL that +really is a canonical string. [0]

[0]: https://www.debian.org/doc/debian-policy/ch-controlfields.ht...

[ Parent | on HN ]