#showerthoughts The problem is in upstream and has only entered Debian Sid/unstable.
Does this mean that for example bleeding edge Arch (btw) sshd users are compromised already ?
Arch had a patch rolled out yesterday [1][2][3] that switches to the git repo. On top of that the logic in the runtime shim and build script modifier was orchestrated to target Debian and RPM build systems and environments [4].
The link mentions that it is only ran as part of a debian or RPM package build. Not to mention that on Arch sshd is not linked against liblzma anyways.
t y for sharing.
#showerthoughts The problem is in upstream and has only entered Debian Sid/unstable. Does this mean that for example bleeding edge Arch (btw) sshd users are compromised already ?
Arch is on 5.6.1 as of now: https://archlinux.org/packages/core/x86_64/xz/
We at Nixpkgs have barely evaded having it go to a channel used by users and we don’t seem to be affected by the backdoor.
Arch had a patch rolled out yesterday [1][2][3] that switches to the git repo. On top of that the logic in the runtime shim and build script modifier was orchestrated to target Debian and RPM build systems and environments [4].
[1] https://gitlab.archlinux.org/archlinux/packaging/packages/xz/-/commit/881385757abdc39d3cfea1c3e34ec09f637424ad
[2] https://gitlab.archlinux.org/archlinux/packaging/packages/xz/-/issues/2
[3] https://security.archlinux.org/CVE-2024-3094
[4] https://www.openwall.com/lists/oss-security/2024/03/29/4
The link mentions that it is only ran as part of a debian or RPM package build. Not to mention that on Arch sshd is not linked against liblzma anyways.
Arch has pushed the patched
xzjust a few hours ago: https://archlinux.org/news/the-xz-package-has-been-backdoored/Thanks a bunch.
It was also on Gentoo. I had this version installed for a day or two.
Since you didn’t build a RPM or DEB package however, your didn’t compile in the backdoor.
Yeah, it’s probably fine. I also don’t use systemd. I was just pointing out that another rolling release distribution had the affected version.
Homebrew rolled back the release after finding out
Here’s a link to the PR for anyone who’s interested