- cross-posted to:
- technology@lemmy.zip
TL;DR there was a backdoor found in the XZ program. All major distros have been updated but it is recommended that you do a fresh install on systems that are exposed to the internet and that had the bad version of the program. Only upstream distros were affected.
For those on Android running Termux, it is also affected. Just checked my version of xz-utils and it was 5.6.1. Running “pkg upgrade” will roll back to version 5.4.5 (tagged as “5.6.1+really5.4.5” for both liblzma and xz-utils packages).
Makes you wonder why Termux ships the latest stuff. It might be smart to allow more time for critical problems to get caught.