In the latest liblzma update, a trusted bad actor called 'JiaT75' implemented a backdoor which allows RCE (sending calls to system()) on ssh connections. Here I'm looking into the case and explaining how it works. Links: - AndresFreundTec on Mastodon: https://mastodon.social/@AndresFreundTec/112180083704606941 - openwall email: https://www.openwall.com/lists/oss-security/2024/03/29/4 - debian repo: https://salsa.debian.org/debian/xz-utils/-/blob/debian/unstable/m4/build-to-host.m4?ref_type=heads#L63 - Filippo Valsorda on bsky: https://bsky.app/profile/filippo.abyssdomain.expert/post/3kowjkx2njy2b