4 ms·
I wondered about this. I saw the note at the bottom "RedHat announces that the backdoored xz shipped in Fedora Rawhide and Fedora Linux 40 beta" but saw nothing
by itslennysfault 3y ago
I wondered about this. I saw the note at the bottom "RedHat announces that the backdoored xz shipped in Fedora Rawhide and Fedora Linux 40 beta" but saw nothing in the timeline explaining when/how it made it into Fedora.
- rwmj 3y agoThese are the Fedora packages for xz that are vulnerable. If you click through the links you can see when they were added: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/BAO5S2VGTTWD6MHHCFHTAIAHZQFMOGAQ/ https://lists.fedoraproject.org/archives/list/devel@lists.fe... (https://archive.ph/diGNB https://archive.ph/diGNB) This is the rough sequence of events in Fedora: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/YTOGJVBNOSW7FSEE7B35GETS25KFPKBO/ https://lists.fedoraproject.org/archives/list/devel@lists.fe... (https://archive.ph/e0SdX https://archive.ph/e0SdX)