4 ms·

OpenSSH and Linux were not targeted/affected. xz and the Debian distribtion of OpenSSH were targeted.

• cpach 3y ago
  Fedora too.
• pama 3y ago
  The core source of the vulnerability (symbol lookup order allowing a dependency to preempt a function) might theoretically be fixed at the Linux+OpenSSH level.
  • wolverine876 3y ago
    It's in their ecosystem; they should be concerned about other similar attacks and about addressing the fears of many users, developers, etc.
  • formerly_proven 3y ago
    Damien Miller (OpenSSH maintainer, OpenBSD committer) has written a patch that implements the relevant libsystemd functionality without libsystemd: https://bugzilla.mindrot.org/show_bug.cgi?id=2641#c13 https://bugzilla.mindrot.org/show_bug.cgi?id=2641#c13
    • bobby_the_whale 3y ago
      [dead]