Conversation

Notices

1. nixCraft 🐧 (nixcraft@mastodon.social)'s status on Saturday, 30-Mar-2024 02:51:27 JST nixCraft 🐧

   Backdoor in upstream xz/liblzma leading to ssh server compromise https://www.openwall.com/lists/oss-security/2024/03/29/4 #unix #linux #openssh #infosec #security

   • nixCraft 🐧 (nixcraft@mastodon.social)'s status on Saturday, 30-Mar-2024 02:58:03 JST nixCraft 🐧

     in reply to

     • yianiris

     @yianiris hard to say. but openwall pages says: "openssh does not directly use liblzma. However debian and several other
     distributions patch openssh to support systemd notification, and libsystemd does depend on lzma." I guess we need to wait and see more info.

   • yianiris (yianiris@kafeneio.social)'s status on Saturday, 30-Mar-2024 02:58:04 JST yianiris

     in reply to

     Does this mean that if you are NOT using systemd you have nothing to worry about?

     Introduction:

     https://www.phoronix.com/news/XZ-CVE-2024-3094

     Specifics:
     https://www.openwall.com/lists/oss-security/2024/03/29/4

     @nixCraft