Backdoor in upstream xz/liblzma leading to SSH server compromise

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by speleding on Saturday March 30, 2024 @11:02AM (#39875510)

PSA: I just noticed homebrew installed the compromised version on my Mac as a dependency of some other package. You may want to check this to see what version you get:

   xz --version

Homebrew has already taken action, a `brew upgrade` will downgrade back to the last known good version.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by jonahx on Saturday March 30, 2024 @11:28AM (#39875753)

I also had a homebrew installed affected version.

I understand it's unlikely, but is there anything I can do to check if the backdoor was used? Also any other steps I should take after "brew upgrade"?

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by tomputer on Saturday March 30, 2024 @12:10PM (#39876159)

Quoting[1] from Homebrew on Github:

>> Looks like that Homebrew users (both macOS and Linux, both Intel and ARM) are unlikely affected?

> Correct. Though we do not appear to be affected, this revert was done out of an abundance of caution.

[1] https://github.com/Homebrew/homebrew-core/pull/167512

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by cozzyd on Saturday March 30, 2024 @11:33AM (#39875800)

Is it actually compromised on homebrew though? I guess we can't be sure but it seemed to be checking if it was being packaged as .deb or .rpm?

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by mthoms on Saturday March 30, 2024 @11:10AM (#39875576)

Thanks for this. I just ran brew upgrade and the result was as you described:

  xz 5.6.1 -> 5.4.6

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by erhaetherth on Saturday March 30, 2024 @01:02PM (#39876542)

Is 5.2.2 safe? Just 5.6.0 and 5.6.1 are bad?

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by pmarreck on Sunday March 31, 2024 @09:12AM (#39883956)

sorry, what exact version(s) is the one(s) affected again?

(or SHAs, etc.)

(EDIT: 5.6.0 and 5.6.1 ?)

(EDIT 2: Ooof, looks like the nix unstable channel uses xz 5.6.1 at this time)

I use Nix to manage this stuff on Mac, not Homebrew...

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by redxtech on Sunday March 31, 2024 @11:04PM (#39890543)

GitHub disabled the xz repo, making it a bit more difficult for nix to revert to an older version. They've made a fix, but it will take several more days for the build systems to finish rebuilding the ~220,000 packages that depend on the bootstrap utils.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by kreetx on Monday April 01, 2024 @04:46AM (#39891980)

Here is the discussion https://github.com/NixOS/nixpkgs/issues/300055

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by account42 on Wednesday April 03, 2024 @06:33AM (#39915629)

Lol they shouldn't be relying on GitHub in the first place.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by rrrix1 on Thursday April 04, 2024 @09:50PM (#39937920)

What should they be relying on instead? Maybe rsync everything to an FTP server? Or Torrents? From your other comments, you seem to think no one should ever use GitHub for anything.

[ Parent | on HN ]