4 ms·
Short summary is that it allows auth bypass, not just RCE.
by aeyes 3y ago
Short summary is that it allows auth bypass, not just RCE.
- bilekas 3y agoYes, I understand.. It's just not a surprise.
- ckcheng 3y agoIt was surprising because previously we had: 'XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."' [0]. [0]: https://news.ycombinator.com/item?id=39877267 https://news.ycombinator.com/item?id=39877267 (811 comments)
- bilekas 3y agoDid you understand the XZ backdoor before the rest of us ? We will figure it out. With all of our stubborn ways, we can document it. Clap
- mr_mitm 3y agoRCE as root is already the worst case though. The auth bypass is basically just a convenience feature of the backdoor. So yeah it's mildly interesting but not really a new development of the story.