Backdoor in upstream xz/liblzma leading to SSH server compromise

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by bobba27 on Saturday March 30, 2024 @04:27AM (#39872925)

For the duration of a major release, up until ~x.4 pretty much everything from upstream gets backported with a delay of 6-12 months, depending on how conservative to change the rhel engineer maintaining this part of the kernel is.

After ~x.4 things slow down and only "important" fixes get backported but no new features.

After ~x.7 or so different processes and approvals come into play and virtually nothing except high severity bugs or something that "important customer" needs will be backported.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by worthless-trash on Saturday March 30, 2024 @04:59AM (#39873070)

Sadly, 8.6 and 9.2 kernel are the exception to this. Mainly as they are openshift container platform and fedramp requirements.

The goal is that 8.6, 9.2 and 9.4 will have releases at least every two weeks.

Maybe soon all Z streams will have a similar release cadence to keep up with the security expectations, but will keep a very similar expectations that you outlined above.

[ Parent | on HN ]