mox to Selfhosted@lemmy.worldEnglish • edit-29 months agoBackdoor in upstream xz/liblzma leading to ssh server compromisewww.openwall.commessage-square9arrow-up1179arrow-down13file-textcross-posted to: netsec@links.hackliberty.orglinux@lemmy.worldnetsec@lemmy.worldprogramming@programming.devcybersecurity@sh.itjust.workshackernews@lemmy.smeargle.fanssecurity@lemmy.mllinux@lemmy.ml
arrow-up1176arrow-down1external-linkBackdoor in upstream xz/liblzma leading to ssh server compromisewww.openwall.commox to Selfhosted@lemmy.worldEnglish • edit-29 months agomessage-square9file-textcross-posted to: netsec@links.hackliberty.orglinux@lemmy.worldnetsec@lemmy.worldprogramming@programming.devcybersecurity@sh.itjust.workshackernews@lemmy.smeargle.fanssecurity@lemmy.mllinux@lemmy.ml
Related discussion: https://news.ycombinator.com/item?id=39865810 https://news.ycombinator.com/item?id=39877267 Advisories: CVE-2024-3094 Arch Debian openSUSE Red Hat
minus-square@vext01linkEnglish9•9 months agoIn case, like me, you were wondering what this has to do with ssh: openssh does not directly use liblzma. However debian and several other distributions patch openssh to support systemd notification, and libsystemd does depend on lzma.
In case, like me, you were wondering what this has to do with ssh: