Arch Linux

7777 readers

1 users here now

The beloved lightweight distro

founded 4 years ago

MODERATORS

k_o_t@lemmy.ml

369

The xz package has been backdoored, you need to update your system now (archlinux.org)

submitted 8 months ago by Fubarberry@sopuli.xyz to c/archlinux@lemmy.ml

44 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] SuperIce@lemmy.world 11 points 8 months ago (1 children)

To be fair, the backdoor only gets enabled when built as an RPM or Deb package, which doesn't apply to Arch Linux, and also requires openSSH to be linked to liblzma, which is also not the case on Arch. So from what we know so far, the Arch packages should not have had the vulnerability. The risk now is whether there are other vulnerabilities or backdoors that haven't been discovered which is why Arch made the update building directly from the git source instead of the known modified source tarball.