CVE-2024-3094: Urgent alert for Fedora Linux 40 and Rawhide users

2 years ago by petsoi to c/linux

Summary: The latest versions of the “xz” tools and libraries contain malicious code that appears to be intended to allow unauthorized access. Specifically, this code is present in versions 5.6.0 and 5.6.1 of the libraries. Fedora Linux 40 users may have received version 5.6.0, depending on the timing of system updates. Fedora Rawhide users may have received version 5.6.0 or 5.6.1.
load all comments
thurstylark 41 points 2 years ago

Me: fixes exposure to vuln

Also me: grabs popcorn

This is going to be an interesting story once this all quiets down...

path: 0 8948389, hotness: undefined, score: 41, children: 6
Bitrot 48 points 2 years ago

Gonna take a bit. The dudes been doing the releases for over a year, everything they touched is suspect now even if nothing earlier is known. Also some other associated accounts have been doing shady stuff too.

And that’s just one project that had a burnt out maintainer who welcomed some help from this guy. There are probably others. The hobby project becoming a core piece is a big issue.

path: 0 8948389 8948510, hotness: undefined, score: 48, children: 3
brunacho 10 points 2 years ago

Gonna take a bit. The dudes been doing the releases for over a year, everything they touched is suspect now even if nothing earlier is known. Also some other associated accounts have been doing shady stuff too.

gonna take even a bit more now. Github closed the account and project making it really difficult to see their commits and merges and analyze them.

path: 0 8948389 8948510 8952480, hotness: undefined, score: 10, children: 1
Bitrot 6 points 2 years ago path: 0 8948389 8948510 8952480 8955005, hotness: undefined, score: 6, children: 0
linux
linux

@lemmy.ml

login for more options
65961
9047
4822

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

  • Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
  • No misinformation
  • No NSFW content
  • No hate speech, bigotry, etc

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

go to feed...