aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorXe Iaso <me@xeiaso.net>2024-03-29 14:57:53 -0400
committerXe Iaso <me@xeiaso.net>2024-03-29 14:57:53 -0400
commit646509045848a0495ff0f4779b8a8e3e5968ffa1 (patch)
tree575de993eb0fbb7fb71d7089fac23ad353a24d04
parent472fb74ece2d8a1f6df7fb4ffc6db8c7c43b81f7 (diff)
downloadxesite-646509045848a0495ff0f4779b8a8e3e5968ffa1.tar.xz
xesite-646509045848a0495ff0f4779b8a8e3e5968ffa1.zip
fix a suggestion from sam_ on IRC
Signed-off-by: Xe Iaso <me@xeiaso.net>
-rw-r--r--lume/src/notes/2024/xz-vuln.mdx2
1 files changed, 1 insertions, 1 deletions
diff --git a/lume/src/notes/2024/xz-vuln.mdx b/lume/src/notes/2024/xz-vuln.mdx
index 93fb52a..d27a1c0 100644
--- a/lume/src/notes/2024/xz-vuln.mdx
+++ b/lume/src/notes/2024/xz-vuln.mdx
@@ -15,7 +15,7 @@ The [xz/liblzma project](https://github.com/tukaani-project/xz) has released ver
The combination of this and patches made by some distributions to the interactions between liblzma, libsystemd, and sshd have resulted in a situation where an attacker can compromise a system by sending a malicious payload to an sshd server.
-We are lucky. This only affects AMD64 Linux systems. The vulnerability is in a specific RSA function. The exploit is in the wild. This is also a very new version of xz/liblzma, so it is not widely deployed yet. This is also unlikely to affect anything other than Glibc (because of glibc IFUNC support), so if you use [musl](https://musl.libc.org/) or another libc implementation, you are likely safe.
+We are lucky. This only affects AMD64 Linux systems. Currently, incomplete analysis of the vulnerability suggests that this only targets a specific RSA function used in sshd. The exploit is in the wild. This is also a very new version of xz/liblzma, so it is not widely deployed yet. This is also unlikely to affect anything other than Glibc (because of glibc IFUNC support), so if you use [musl](https://musl.libc.org/) or another libc implementation, you are likely safe.
If you are using a distribution that has not yet released xz 5.6.0 or 5.6.1, you are likely safe.