all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
From: Tomas Volf <~@wolfsden.cz>
To: Felix Lechner <felix.lechner@lease-up.com>
Cc: Ryan Prior <rprior@protonmail.com>,
	Guix Devel <guix-devel@gnu.org>,
	guix-security@gnu.org
Subject: Re: Backdoor in upstream xz-utils
Date: Fri, 29 Mar 2024 21:55:59 +0100	[thread overview]
Message-ID: <Zgcq3yNyNSAmIQqs@ws> (raw)
In-Reply-To: <878r203h7k.fsf@lease-up.com>

[-- Attachment #1: Type: text/plain, Size: 777 bytes --]

Hello,

On 2024-03-29 13:39:59 -0700, Felix Lechner via Development of GNU Guix and the GNU System distribution. wrote:
> > Is there a way we can blacklist known bad versions?
>
> Having said all that, I am not sure Guix is affected.
>
> On my systems, the 'detect.sh' script shows no referece to liblzma in
> sshd.  Everyone, please send additional reports.

If nothing else, our xz is at 5.2.8.  I think the question was if there is a way
to blacklist specific known tarball to ensure no-one updates to it by accident.

(I do not believe Guix would be vulnerable even when built from the malicious
tarball, but that is a separate issue.)

Have a nice day,
Tomas

--
There are only two hard things in Computer Science:
cache invalidation, naming things and off-by-one errors.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

  reply	other threads:[~2024-03-29 20:56 UTC|newest]

Thread overview: 34+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-03-29 20:57 Backdoor in upstream xz-utils John Kehayias
2024-03-29 17:51 ` Ryan Prior
2024-03-29 20:39   ` Felix Lechner via Development of GNU Guix and the GNU System distribution.
2024-03-29 20:55     ` Tomas Volf [this message]
2024-03-30 21:02       ` Ricardo Wurmus
2024-04-04 10:34   ` backdoor injection via release tarballs combined with binary artifacts (was Re: Backdoor in upstream xz-utils) Giovanni Biscuolo
2024-04-04 15:12     ` Attila Lendvai
2024-04-04 16:47       ` Giovanni Biscuolo
2024-04-04 15:47     ` Giovanni Biscuolo
2024-04-04 19:48       ` Attila Lendvai
2024-04-04 20:32         ` Ekaitz Zarraga
2024-04-10 13:57           ` Ludovic Courtès
2024-04-11 12:43             ` Andreas Enge
2024-04-11 12:56               ` Ekaitz Zarraga
2024-04-11 13:49                 ` Andreas Enge
2024-04-11 14:05                   ` Ekaitz Zarraga
2024-04-13  0:14                   ` Skyler Ferris
2024-04-19 14:31                     ` Ludovic Courtès
2024-04-13  6:50                   ` Giovanni Biscuolo
2024-04-13 10:26                     ` Skyler Ferris
2024-04-13 12:47                       ` Giovanni Biscuolo
2024-04-14 16:22                         ` Skyler Ferris
2024-04-12 13:09               ` Attila Lendvai
2024-04-12 20:42               ` Ludovic Courtès
2024-04-13  6:13             ` Giovanni Biscuolo
2024-05-07 18:22             ` 3 kinds of bootstrap (was Re: backdoor injection via release tarballs combined with binary artifacts) Simon Tournier
2024-04-05 10:13         ` backdoor injection via release tarballs combined with binary artifacts (was Re: Backdoor in upstream xz-utils) Giovanni Biscuolo
2024-04-05 14:51           ` Attila Lendvai
2024-04-13  7:42             ` Giovanni Biscuolo
2024-04-04 23:03     ` Ricardo Wurmus
2024-04-05  7:06       ` Giovanni Biscuolo
2024-04-05  7:39         ` Ricardo Wurmus
2024-04-05 16:52     ` Jan Wielkiewicz
2024-03-31 15:04 ` Backdoor in upstream xz-utils Rostislav Svoboda

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=Zgcq3yNyNSAmIQqs@ws \
    --to=~@wolfsden.cz \
    --cc=felix.lechner@lease-up.com \
    --cc=guix-devel@gnu.org \
    --cc=guix-security@gnu.org \
    --cc=rprior@protonmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.