search

Portable-Network-Archive / liblzma-rs

Bindings to liblzma in Rust (xz streams in Rust)
Apache License 2.0
12 stars 5 forks source link

`xz` backdoor is included in 0.3.2 #106

Closed louislang closed 5 months ago

louislang commented 5 months ago

The current distribution (v0.3.2) on Crates.io contains the test files for xz that contain the backdoor. The test files themselves are not included in either the .tar.gz nor the .zip tags here on Github and are only present in liblzma-sys_0.3.2.crate that is installed from Crates.io.

The hashes for these files are as follows:

It remains to be seen if these are executed in any way. Still, it seems prudent to not ship these files if it can be avoided.

ChanTsune commented 5 months ago

Thank you for your report @louislang ! I'll release a version without them as soon as possible.