In the latest liblzma update, a trusted bad actor called 'JiaT75' implemented a backdoor which allows RCA calls to system() on ssh connections. Here I'm look...
However, out of an abundance of caution, we advise users to remove the malicious code from their system by upgrading either way. This is because other yet-to-be discovered methods to exploit the backdoor could exist.
So if I have been using arch with infected xz library to connect to a Debian LTS server, am I compromised?
Assume yes until you can prove otherwise.
From what I’ve read both arch and debian stable aren’t vulnerable to this. It targeted mostly debian-testing.
Arch put out a statement saying users should update to a non infected binary even though it doesn’t appear to affect Arch https://archlinux.org/news/the-xz-package-has-been-backdoored/
deleted by creator
deleted by creator
I would pay attention to the news. You definitely want to upgrade immediately if you have not already