Re: backdoor in upstream xz/liblzma leading to ssh server compromise

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
Re: backdoor in upstream xz/liblzma leading to ssh server compromise

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Solar Designer &lt;solar () openwall com&gt;

Date: Sat, 30 Mar 2024 17:24:59 +0100

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
On Sat, Mar 30, 2024 at 11:32:54AM -0400, Jeffrey Walton wrote:
Lasse published a statement at &lt;https://tukaani.org/xz-backdoor/&gt;.

Quoting here for archival, and ease and safety of access:

---
XZ Utils backdoor
Lasse Collin

This page is short for now but it will get updated as I learn more about the incident. Most likely it will be during 
the first week of April 2024.

The Git repositories of XZ projects are on git.tukaani.org.

xz.tukaani.org DNS name (CNAME) has been removed. The XZ projects currently don't have a home page. This will be fixed 
in a few days.

Facts

- CVE-2024-3094

- XZ Utils 5.6.0 and 5.6.1 release tarballs contain a backdoor. These tarballs were created and signed by Jia Tan.

- Tarballs created by Jia Tan were signed by him. Any tarballs signed by me were created by me.

- GitHub accounts of both me (Larhzu) and Jia Tan are suspended.

- xz.tukaani.org (DNS CNAME) was hosted on GitHub pages and thus is down too. It might be moved to back to the main 
tukaani.org domain in the near future.

- Only I have had access to the main tukaani.org website, git.tukaani.org repositories, and related files. Jia Tan only 
had access to things hosted on GitHub, including xz.tukaani.org subdomain (and only that subdomain).

Links

- Details by Andres Freund
https://www.openwall.com/lists/oss-security/2024/03/29/4

- FAQ by thesamesam
https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27

- Gentoo bug 928134
https://bugs.gentoo.org/928134

- Debian bug 1068024
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024
---

Alexander

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

Re: Re: backdoor in upstream xz/liblzma leading to ssh server compromise, (continued)

Re: Re: backdoor in upstream xz/liblzma leading to ssh server compromise Marc Deslauriers (Mar 30)
Re: Re: backdoor in upstream xz/liblzma leading to ssh server compromise Marcin Wolcendorf (Mar 30)

Re: backdoor in upstream xz/liblzma leading to ssh server compromise Tavis Ormandy (Mar 30)
Re: Re: backdoor in upstream xz/liblzma leading to ssh server compromise Marc Deslauriers (Mar 30)
Re: backdoor in upstream xz/liblzma leading to ssh server compromise Tavis Ormandy (Mar 30)

Re: backdoor in upstream xz/liblzma leading to ssh server compromise Bo Anderson (Mar 30)

Re: Re: backdoor in upstream xz/liblzma leading to ssh server compromise Loganaden Velvindron (Mar 30)
Re: Re: backdoor in upstream xz/liblzma leading to ssh server compromise Bjoern Franke (Mar 30)
Re: Re: backdoor in upstream xz/liblzma leading to ssh server compromise Pierre-Elliott Bécue (Mar 30)
Re: Re: backdoor in upstream xz/liblzma leading to ssh server compromise Jeffrey Walton (Mar 30)
Re: backdoor in upstream xz/liblzma leading to ssh server compromise Solar Designer (Mar 30)

Re: Re: backdoor in upstream xz/liblzma leading to ssh server compromise Russ Allbery (Mar 30)

Re: Re: backdoor in upstream xz/liblzma leading to ssh server compromise Mike O'Connor (Mar 30)

Re: Re: backdoor in upstream xz/liblzma leading to ssh server compromise Florian Weimer (Mar 30)

Re: backdoor in upstream xz/liblzma leading to ssh server compromise sjw (Mar 29)

Re: backdoor in upstream xz/liblzma leading to ssh server compromise sjw (Mar 30)

Re: backdoor in upstream xz/liblzma leading to ssh server compromise Alexander E. Patrakov (Mar 30)

Re: backdoor in upstream xz/liblzma leading to ssh server compromise Collin Funk (Mar 30)

Re: backdoor in upstream xz/liblzma leading to ssh server compromise Jonathan Schleifer (Mar 30)

Re: Re: backdoor in upstream xz/liblzma leading to ssh server compromise Rein Fernhout (Levitating) (Mar 30)

Re: Re: backdoor in upstream xz/liblzma leading to ssh server compromise Jonathan Schleifer (Mar 30)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->