Re: [oss-security] backdoor in upstream xz/liblzma leading to ssh server compromise

2024-03-30 Thread Andy Smith
Hi, On Sat, Mar 30, 2024 at 08:57:14PM +, fxkl4...@protonmail.com wrote: > so is this a threat to us normal debian users If you have to ask, i.e. you do not know how to check that your Debian install is secured against extremely well known recent exploits that have been plastered across the

Re: [oss-security] backdoor in upstream xz/liblzma leading to ssh server compromise

2024-03-30 Thread Michel Verdier
On 2024-03-30, fxkl4...@protonmail.com wrote: > so is this a threat to us normal debian users > if so how do we fix it Debian stable is not affected, Debian testing, unstable and experimental must be updated. https://lists.debian.org/debian-security-announce/2024/msg00057.html

Re: [oss-security] backdoor in upstream xz/liblzma leading to ssh server compromise

2024-03-30 Thread fxkl47BF
alton wrote: >> >> Seems relevant since Debian adopted xz about 10 years ago. >> >> -- Forwarded message - >> From: Andres Freund >> Date: Fri, Mar 29, 2024 at 12:10 PM >> Subject: [oss-security] backdoor in upstream xz/liblzma leading to s

Re: [oss-security] backdoor in upstream xz/liblzma leading to ssh server compromise

2024-03-30 Thread Jeffrey Walton
eund > Date: Fri, Mar 29, 2024 at 12:10 PM > Subject: [oss-security] backdoor in upstream xz/liblzma leading to ssh > server compromise > To: > > Hi, > > After observing a few odd symptoms around liblzma (part of the xz package) on > Debian sid installations over the l

Re: Fwd: [oss-security] backdoor in upstream xz/liblzma leading to ssh server compromise

2024-03-29 Thread Andy Smith
Hello, On Fri, Mar 29, 2024 at 01:52:18PM -0400, Jeffrey Walton wrote: > Seems relevant since Debian adopted xz about 10 years ago. Though we do not know how or why this developer has come to recently put apparent exploits in it, so we can't yet draw much of a conclusion beyond "sometimes people

Re: Fwd: [oss-security] backdoor in upstream xz/liblzma leading to ssh server compromise

2024-03-29 Thread Roberto C . Sánchez
On Fri, Mar 29, 2024 at 01:52:18PM -0400, Jeffrey Walton wrote: > Seems relevant since Debian adopted xz about 10 years ago. > Also note that this has been addressed in Debian: https://lists.debian.org/debian-security-announce/2024/msg00057.html Provided here for the benefit those who are not