Hopefully this does not affect you but if you are running something like Arch, OpenSUSE tumbleweed, Debian sid or Fedora Rawhide and use SSH for remote access you should do a full wipe.
Hopefully this does not affect you but if you are running something like Arch, OpenSUSE tumbleweed, Debian sid or Fedora Rawhide and use SSH for remote access you should do a full wipe.
Wow, thank you for sharing this! Grumblegrumble have to reinstall my system…
This straight on the back of a thread about flatpak verification and security - a reminder that a lot of the incredible work of a distribution, especially Debian, is a community of people curating packages with care, and not just for how quick they can be made to work together.
Also a highlight for the work toward fully replicatable systems - if I understand right, the exploit here was snuck in in the binary, not in the source code.
No, it was snuck into the website download of the source code. If you got it from GitHub it was fine, if you got it from their website you got pwnd
That’s not correct as far as I can tell. The backdoored code ended up in release tarballs (but not source tarballs because of
autoconffuckery), see eg. this mailing list discussion.