The xz package that has already entered the current F40 pre-release versions/variants and rawhide contains malicious code. This does NOT affect users of the Fedora releases (F38, F39 are thus not affected), but all users who use already F40 pre-release versions/variants or rawhide shall read this: Article: CVE details: https://access.redhat.com/security/cve/CVE-2024-3094 Be aware that this is CVE criticality 10: this is the highest risk factor. Also be aware that the header of the RH arti...
  •  Deathcrow   ( @Deathcrow@lemmy.ml ) 
    4•3 months ago

    or substituted its own SSH host keys,

    why would the backdoor do that? It would immediately expose itself because every ssh client on the planet warns about changed host keys when connecting.

    •  gnuplusmatt   ( @gnuplusmatt@reddthat.com ) 
      2•3 months ago

      Perhaps it was a poorly worded way of suggesting that invalidating host keys would invalidate all client keys it could potentially generate? Either way it’s a lot of speculation.

      Resetting the keys and SSH config on any potentially compromised host is probably not a terrible idea