💭 Arch Linux - News: The xz package has been backdoored
=======================================================

!https://archlinux.org/news/the-xz-package-has-been-backdoored/

Date: April 16, 2024

Arch Linux - News: The xz package has been backdoored
 archlinux.org [1]

Check your system to see if you are vulnerable to the xz backdoor.

I found this line most pertanent to me.

> The xz packages prior to version 5.6.1-2 (specifically 5.6.0-1 and 5.6.1-1) contain this backdoor.

Also it appears that arch is not vulnerable as it does not directly link openssh to liblzma, so the known attack vecotor is not possible. read to the end of the linked article for more.

!!! note

 This post is a thought [2]. It's a short note that I make
 about someone else's content online #thoughts [3]

References:
[1]: https://archlinux.org/news/the-xz-package-has-been-backdoored/
[2]: /thoughts/
[3]: /tags/thoughts/