Uhhh heads up everyone:
https://lwn.net/ml/oss-security/20240329155126.kjjfduxw2yrlxgzm@awork3.anarazel.de/
> After observing a few odd symptoms around liblzma (part of the xz package) on Debian sid installations over the last weeks (logins with ssh taking a lot of CPU, valgrind errors) I figured out the answer:
> The upstream xz repository and the xz tarballs have been backdoored.
As far as Debian is concerned, seems like only Sid was affected (fixed):
https://lists.debian.org/debian-security-announce/2024/msg00057.html
Generally, XZ Utils versions 5.6.0 and 5.6.1.
This entry was edited (7 months ago)
Agnieszka R. Turczyńska
in reply to Michał "rysiek" Woźniak · 🇺🇦 • • •[SECURITY] [DSA 5649-1] xz-utils security update
lists.debian.org