Closed NobodyXu closed 5 months ago
Oh it seems that we are using xz 5.4, so it should ok
Not even 5.4, we are using xz 5.2.5 (#65) :joy:. No one reviewed the update to 5.4.1 #108.
Thanks for correction, I guess it is actually a good thing it hasn't been merged.
At the very least, people using vendored xz-rs and lxmz won't get hit by the malicious code.
https://www.phoronix.com/news/XZ-CVE-2024-3094
Probably a good idea to update the compilation of vendored xz to use <5.6.0