Ouch ! LZMA ssh backdoor

It was found in the upstream git repo sources, and particularly well hidden.

Original article here:

https://www.openwall.com/lists/oss-security/2024/03/29/4

See also

“Backdoor in upstream xz/liblzma leading to SSH server compromise” (supposedly primarily relevant for OpenSSH w/ systemd patches) [CVE-2024-3094]
byu/MartinsRedditAccount insysadmin

#lzma #backdoor #ssh