Backdoor found in widely used Linux utility breaks encrypted SSH connections
arstechnica.com
Malicious code planted in xz Utils has been circulating for more than a month.

TL;DR there was a backdoor found in the XZ program. All major distros have been updated but it is recommended that you do a fresh install on systems that are exposed to the internet and that had the bad version of the program. Only upstream distros were affected.

  • claudiom@blendit.bsd.cafe
    13·
    7 months ago

    For those on Android running Termux, it is also affected. Just checked my version of xz-utils and it was 5.6.1. Running “pkg upgrade” will roll back to version 5.4.5 (tagged as “5.6.1+really5.4.5” for both liblzma and xz-utils packages).

    • Possibly linux@lemmy.zipOPEnglish
      7·
      7 months ago

      Makes you wonder why Termux ships the latest stuff. It might be smart to allow more time for critical problems to get caught.

      • RvTV95XBeo@sh.itjust.works
        9·
        7 months ago

        Probably for the exact same reason this backdoor was introduced. Users complain about slow feature rollouts so (unpaid) devs (maintaining software in their spare time out of the kindness of their hearts) cut corners. In some situations that looks like bringing on a second maintainer without thorough vetting, in others it looks like importing upstream packages without thorough vetting.

        Don’t blame the Termux devs here, blame the community that keeps pushing them to move faster.