3 ms·
OpenWRT also uploaded backdoored packages.
by INTPenis 3y ago
OpenWRT also uploaded backdoored packages.
- 1oooqooq 3y agohttps://forum.openwrt.org/t/project-statement-about-xz-5-6-1-cve-2024-3094/193250/11 https://forum.openwrt.org/t/project-statement-about-xz-5-6-1... you might want to tell them that.
- INTPenis 3y agoI think they know seeing as they renamed the files with the .backdoored suffix. But I think you're referring to the fact that it was dormant code. I still thought it worth mentioning in the context of a website that seemed to list all distros affected. >Debian sid, Fedora Rawhide, the Fedora 40 beta, openSUSE Tumbleweed, and Kali Linux all briefly shipped the compromised package. NixOS unstable also shipped the compromised version, but was not vulnerable because it does not patch OpenSSH to link libsystemd.
- pxc 3y ago> NixOS unstable also shipped the compromised version, but was not vulnerable because it does not patch OpenSSH to link libsystemd In addition to not including those patches to build OpenSSH against systemd, Nixpkgs builds liblzma from the GitHub snapshots, not the dist tarballs, so the source Nixpkgs builds from never contained the malicious m4 scripts that actually inject the backdoor code in the liblzma binaries. Plus those scripts explicitly and exclusively target DEB and RPM builds, so they wouldn't have run on Nix or Arch builds.
- zekica 3y agoNot really, they updated to 5.6.x but used code from the git tag, not from the tarball, and only in their snapshot (not stable) version. The git repository never contained <i>build-to-host.m4</i>, so the injected build step was never executed and not backdoored library was produced.