4 ms·

So wait, if I did a find / -n 'liblzma*' and saw 5.4, I'm good? This is only 5.6 and 5.6.1, right?

• xorcist 3y ago
  From what is publicly known at the moment, yes. Note however that xzutils home page says that "versions 5.2.12, 5.4.3 and later have been signed with Jia Tan's OpenPGP key" so there would have been plenty more opportunities. We may just have seen the beginning. Whoever did this played the long game. Also note that there was proposed patches by this compromised project maintainer to oss-fuzz and valgrind to avoid the detection of this backdoor.
• botanical 2y ago
  The attacker had 750 previous commits; maybe it was all for this or maybe there are more vulnerabilities.