Re: backdoor in upstream xz/liblzma leading to ssh server compromise

[Tavis Ormandy <taviso () gmail com>]

On 2024-03-29, Andres Freund wrote:
> Hi,
>
> After observing a few odd symptoms around liblzma (part of the xz package) on
> Debian sid installations over the last weeks (logins with ssh taking a lot of
> CPU, valgrind errors) I figured out the answer:

Thanks Andres, amazing work!

I have a minor procedural question for Solar though, shouldn't this
have been redirected to oss-security immediately from distros? What's
the rationale for an embargo here?

Tavis.

-- 
 _o)            $ lynx lock.cmpxchg8b.com
 /\\  _o)  _o)  $ finger taviso () sdf org
_\_V _( ) _( )  @taviso