News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise. Parent comment

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by gamer191 on Saturday March 30, 2024 @03:13AM (#39872563)
> some binary test files were added later that are probably now suspect

That's confirmed

From https://www.openwall.com/lists/oss-security/2024/03/29/4:

> The files containing the bulk of the exploit are in an obfuscated form in

> tests/files/bad-3-corrupt_lzma2.xz

> tests/files/good-large_compressed.lzma

> committed upstream. They were initially added in

> https://github.com/tukaani-project/xz/commit/cf44e4b7f5dfdbf...

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by m0dest on Saturday March 30, 2024 @06:45AM (#39873585)
It probably makes sense to start isolating build processes from test case resources.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by saagarjha on Saturday March 30, 2024 @08:47AM (#39874345)
Sure but then you can smuggle it into basically any other part of the build process…?
[ Parent | on HN ]