mox to [email protected]English • edit-29 months agoBackdoor in upstream xz/liblzma leading to ssh server compromisewww.openwall.commessage-square9fedilinkarrow-up1176arrow-down13file-textcross-posted to: hackingprogrammingcybersecuritynetseclinux[email protected][email protected][email protected]
arrow-up1173arrow-down1external-linkBackdoor in upstream xz/liblzma leading to ssh server compromisewww.openwall.commox to [email protected]English • edit-29 months agomessage-square9fedilinkfile-textcross-posted to: hackingprogrammingcybersecuritynetseclinux[email protected][email protected][email protected]
Related discussion: https://news.ycombinator.com/item?id=39865810 https://news.ycombinator.com/item?id=39877267 Advisories: CVE-2024-3094 Arch Debian openSUSE Red Hat
minus-square@[email protected]linkfedilinkEnglish9•9 months agoIn case, like me, you were wondering what this has to do with ssh: openssh does not directly use liblzma. However debian and several other distributions patch openssh to support systemd notification, and libsystemd does depend on lzma.
In case, like me, you were wondering what this has to do with ssh: