Jan Schaumann on Nostr: Some good sleuthing and interesting chaining here: CVE-2024-3094: backdoor in ...

Some good sleuthing and interesting chaining here:

CVE-2024-3094: backdoor in upstream xz/liblzma leading to ssh server compromise

inserted m4 code -> configure script -> injected code into xz -> sshd when compiled with liblzma (e.g., used by systemd, what else)

https://www.openwall.com/lists/oss-security/2024/03/29/4