Arch Linux

7750 readers

1 users here now

The beloved lightweight distro

founded 4 years ago

MODERATORS

[email protected]

The xz package has been backdoored, you need to update your system now (archlinux.org)

submitted 7 months ago by [email protected] to c/[email protected]

41 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 0 points 7 months ago (1 children)

To be fair, the backdoor only gets enabled when built as an RPM or Deb package, which doesn't apply to Arch Linux, and also requires openSSH to be linked to liblzma, which is also not the case on Arch. So from what we know so far, the Arch packages should not have had the vulnerability. The risk now is whether there are other vulnerabilities or backdoors that haven't been discovered which is why Arch made the update building directly from the git source instead of the known modified source tarball.

[–] [email protected] 0 points 7 months ago

This is a Linux community, we are not here to be fair???