3 ms·
The test file containing the backdoor seems to be here: https://git.rootprojects.org/root/xz/commit/6e636819e8f070330d835fce46289a3ff72a7b89 https://git.rootpr
by throwaway4good 3y ago
The test file containing the backdoor seems to be here:
https://git.rootprojects.org/root/xz/commit/6e636819e8f070330d835fce46289a3ff72a7b89 https://git.rootprojects.org/root/xz/commit/6e636819e8f07033...
- deng 3y agoYes, the binary "test files" were checked in. But the code that actually decompresses and executes the shell code in that file is in this m4 script, which only exists in the tar archive: https://salsa.debian.org/debian/xz-utils/-/blob/debian/5.6.0-0.2/m4/build-to-host.m4 https://salsa.debian.org/debian/xz-utils/-/blob/debian/5.6.0...