Re: xz backdoor

[Christopher Klooz]

Yes, F40 beta is affected, along with rawhide, but not F38/F39.

https://discussion.fedoraproject.org/t/warning-malicious-code-in-current-...

https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhid...

https://access.redhat.com/security/cve/CVE-2024-3094

https://www.linkedin.com/posts/fedora-project_urgent-security-alert-for-f...

It might be noted that the header of the RH article is wrong and refers to "F41 and
rawhide", whereas the RH article content is correct and refers to "F40 and
rawhide". Other sources, including the publication of Fedora Project (e.g., on
linkedin), also refer to F40 and rawhide. However, the RH CVE article also refers to
"F41 and rawhide".

Can someone from RH check and change the RH article header and the RH CVE page content to
avoid confusion? I tend to assume that "F41 and rawhide" makes no sense at all
since the two are currently equal.

Chris

On 29/03/2024 19.37, Barry wrote:
> Has this shipped on f40 beta?
>
> Barry
>
>> On 29 Mar 2024, at 18:08, Richard W.M. Jones <rjones(a)redhat.com&gt; wrote:
>>
>> 
>>> On Fri, Mar 29, 2024 at 07:00:37PM +0100, Kevin Kofler via devel wrote:
>>> Hi,
>>>
>>> wow: https://www.openwall.com/lists/oss-security/2024/
>>>
>>> I think at this point we clearly cannot trust xz upstream anymore and should
>>> probably fork the project.
>> I kind of agree here, though it saddens me to say it.  Any commit or
>> release by "Jia Tan" or "Hans Jansen" [1] is suspect until
proven
>> otherwise, and those go back 2 or more years.
>>
>> Rich.
>>
>> [1] Putting quotes here because those are almost certainly not real
>> peoples' names.
>>
>> --
>> Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
>> Read my programming and virtualization blog: http://rwmj.wordpress.com
>> virt-top is 'top' for virtual machines.  Tiny program with many
>> powerful monitoring features, net stats, disk stats, logging, etc.
>> http://people.redhat.com/~rjones/virt-top
>> --
>> _______________________________________________
>> devel mailing list -- devel(a)lists.fedoraproject.org
>> To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
>> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>> List Archives:
https://lists.fedoraproject.org/archives/list/[e-mail]
>> Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
> --
> _______________________________________________
> devel mailing list -- devel(a)lists.fedoraproject.org
> To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedoraproject.org/archives/list/[e-mail]
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue