Recent searches
Search options
Administered by:
This is big: one of the xz-utils / liblzma *upstream maintainers* added malicious code to the last couple of releases. This is the person who actually publishes and signs the tarballs. If you are using liblzma 5.6.0 or 5.6.1 make sure to update your packages asap and consider reinstalling the OS or recreating the container.
www.openwall.comoss-security - backdoor in upstream xz/liblzma leading to ssh server compromise
@berto This person seems to have committed to various other repositories, such as the Linux kernel. Do you know if there is a audit on that code as well?
@Logical_Error I don't think I have seen code in the kernel, just mentions to their name in the maintainers file