Recent versions of XZ (since 2022) may be compromised and should be checked

kiwix / kiwix-build

Kiwix & openZIM build engine

GNU General Public License v3.0

86 stars 42 forks source link

Recent versions of XZ (since 2022) may be compromised and should be checked #686

Closed Jaifroid closed 4 months ago

Jaifroid commented 4 months ago

I believe Kiwix may use a "frozen" version of XZ, but we should check that it isn't compromised by the recently discovered back door. See for example https://thehackernews.com/2024/03/urgent-secret-backdoor-found-in-xz.html and for a detailed timeline https://boehs.org/node/everything-i-know-about-the-xz-backdoor.

kelson42 commented 4 months ago

@Jaifroid Thank you for this bug report, very interesting, at so much levels. Currently we distribute binaries with version 5.2.6 of libzma which has been published the 2022-08-12. Weaknesses have been introduced from 2023, so I guess we are not impacted.

kelson42 commented 4 months ago

Official annoucement: https://tukaani.org/xz-backdoor/, only the 5.6.0 and 5.6.1 are impacted.