4 ms·

Have the heads of the targeted projects - including xz (Lasse Collin?), OpenSSH (Theo?), and Linux (Linus) - commented on it? I'm especially interested in how

Have the heads of the targeted projects - including xz (Lasse Collin?), OpenSSH (Theo?), and Linux (Linus) - commented on it? I'm especially interested in how such exploits can be prevented in the future.

strunz 3y ago
https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78b...: >Lasse regularly has internet breaks and is on one at the moment, started before this all kicked off. He has posted an update at https://tukaani.org/xz-backdoor/ https://tukaani.org/xz-backdoor/ and is working with the community.
gowld 3y ago
OpenSSH and Linux were not targeted/affected. xz and the Debian distribtion of OpenSSH were targeted.
- cpach 3y ago
  Fedora too.
- pama 3y ago
  The core source of the vulnerability (symbol lookup order allowing a dependency to preempt a function) might theoretically be fixed at the Linux+OpenSSH level.
  - wolverine876 3y ago
    It's in their ecosystem; they should be concerned about other similar attacks and about addressing the fears of many users, developers, etc.
  - formerly_proven 3y ago
    Damien Miller (OpenSSH maintainer, OpenBSD committer) has written a patch that implements the relevant libsystemd functionality without libsystemd: https://bugzilla.mindrot.org/show_bug.cgi?id=2641#c13 https://bugzilla.mindrot.org/show_bug.cgi?id=2641#c13
    - bobby_the_whale 3y ago
      [dead]