News for hackers. Stuff that matters.

A comment on XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable.". Parent comment

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by transpute on Saturday March 30, 2024 @07:16PM (#39879590)
https://news.ycombinator.com/item?id=39879559

> Libselinux pulls in liblzma too

[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by treasy on Saturday March 30, 2024 @07:31PM (#39879687)
libselinux is the userspace tooling for selinux, it is irrelevant to this specific discussion as the backdoor does not target selinux in any way, and sshd does not have the capabilities required to make use of the libselinux tooling anyway

libselinux is just an unwitting vector to link liblzma with openssh

[ Parent | on HN ]