2 ms·

I think they know seeing as they renamed the files with the .backdoored suffix. But I think you're referring to the fact that it was dormant code. I still tho

I think they know seeing as they renamed the files with the .backdoored suffix. But I think you're referring to the fact that it was dormant code. I still thought it worth mentioning in the context of a website that seemed to list all distros affected. >Debian sid, Fedora Rawhide, the Fedora 40 beta, openSUSE Tumbleweed, and Kali Linux all briefly shipped the compromised package. NixOS unstable also shipped the compromised version, but was not vulnerable because it does not patch OpenSSH to link libsystemd.

pxc 3y ago
> NixOS unstable also shipped the compromised version, but was not vulnerable because it does not patch OpenSSH to link libsystemd In addition to not including those patches to build OpenSSH against systemd, Nixpkgs builds liblzma from the GitHub snapshots, not the dist tarballs, so the source Nixpkgs builds from never contained the malicious m4 scripts that actually inject the backdoor code in the liblzma binaries. Plus those scripts explicitly and exclusively target DEB and RPM builds, so they wouldn't have run on Nix or Arch builds.