Messages in this thread | | | Date | Sat, 30 Mar 2024 14:48:48 +0200 | From | Lasse Collin <> | Subject | Re: [tech-board] [PATCH 00/11] xz: Updates to license, filters, and compression options |
| |
On 2024-03-29 Andrew Morton wrote: > On Fri, 29 Mar 2024 14:51:41 -0600 Jonathan Corbet <corbet@lwn.net> > wrote: > > > > Andrew (and anyone else), please do not take this code right now. > > > > > > Until the backdooring of upstream xz[1] is fully understood, we > > > should not accept any code from Jia Tan, Lasse Collin, or any > > > other folks associated with tukaani.org. It appears the domain, > > > or at least credentials associated with Jia Tan, have been used > > > to create an obfuscated ssh server backdoor via the xz upstream > > > releases since at least 5.6.0. Without extensive analysis, we > > > should not take any associated code. It may be worth doing some > > > retrospective analysis of past contributions as well... > > > > > > Lasse, are you able to comment about what is going on here? > > > > FWIW, it looks like this series has been in linux-next for a few > > days. Maybe it needs to come out, for now at least? > > Yes, I have removed that series.
Thank you. None of these patches are urgent. I'm on a holiday and only happened to look at my emails and it seems to be a major mess.
My proper investigation efforts likely start in the first days of April. That is, I currently know only a few facts which alone are bad enough.
Info will be updated here: https://tukaani.org/xz-backdoor/
-- Lasse Collin
| |