29Mar
XZ compromise and consequences for people having used it
Here's a hot topic:
- https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
- https://lwn.net/Articles/967180/
- https://lwn.net/ml/oss-security/20240329155126.kjjfduxw2yrlxgzm@awork3.anarazel.de/
I'm not an expert in reverse engineering, so my questions are:
Is only SSHD affected? Does merely having the sshd daemon run is enough to get your system compromised or the attacker must have actually accessed the compromised system? Many more packages depend on (are linked to) liblzma including: RPM, GRUB, KMOD, systemd, etc.
Systemd is run by default, RPM is run whenever you do anything with your packages.
