Bug#1068047: Suspicious commit merged in 2021 from account responsible for xz backdoor

2024-03-30 Thread Salvatore Bonaccorso
Control: severity -1 serious Control: found -1 3.6.0-1 Hi Russ, On Fri, Mar 29, 2024 at 07:24:13PM -0700, Russ Allbery wrote: > Package: libarchive13t64 > Version: 3.7.2-1.1 > Severity: important > X-Debbugs-Cc: r...@debian.org > > So far it looks like no one has been able to figure out an

Bug#1068047: Suspicious commit merged in 2021 from account responsible for xz backdoor

2024-03-29 Thread Wesley Schwengle
On Fri, Mar 29, 2024 at 07:24:13PM -0700, Russ Allbery wrote: > So far it looks like no one has been able to figure out an obvious way > for this to be exploitable, but I wanted to make sure that you were > aware of this upstream issue: > > https://github.com/libarchive/libarchive/pull/1609 > >

Bug#1068047: Suspicious commit merged in 2021 from account responsible for xz backdoor

2024-03-29 Thread Russ Allbery
Package: libarchive13t64 Version: 3.7.2-1.1 Severity: important X-Debbugs-Cc: r...@debian.org So far it looks like no one has been able to figure out an obvious way for this to be exploitable, but I wanted to make sure that you were aware of this upstream issue: