3 ms·
The bug was found before it hit production, so to that extent things worked. Not according to the article: "Ubuntu 24.04 LTS (Noble Numbat) also contained
by jqpabc123 3y ago
The bug was found before it hit production, so to that extent things worked.
Not according to the article:
"Ubuntu 24.04 LTS (Noble Numbat) also contained the infected files, which have since been removed. Advisories were also issued by Arch and openSUSE."
Bottom line: This is proof that there is very little vetting of either code or the people involved in these projects. In many cases, the people are unknown/anonymous.
This is a gaping security hole that someone just spent a lot of time and effort to exploit.
- graemep 3y agoApparently not: "The affected version of xz-utils was only in noble-proposed" https://ubuntu.com/security/CVE-2024-3094 https://ubuntu.com/security/CVE-2024-3094
- ranger_danger 3y agoI mean that was always the case with open source. But also the vast majority of programmers, even looking directly at every patch submitted to XZ, wouldn't have found this or had any idea what it could do.