PLEASE. I keep seeing it in memes. As I understand it the latest version of the xz package (present in rolling release distros like Arch and SUSE Tumbleweed) has “a backdoor”, but I have no earthly clue what can be done by malicious folks with access to that backdoor or if I should be afraid or how to check if my distro is compromised or how to prevent damage if it is or (…)

  • ashaman2007
    link
    fedilink
    English
    arrow-up
    8
    ·
    3 months ago

    Just to be sure, you should check whether SSHD is enabled: sudo systemctl status sshd.service If you never enabled it and it’s disabled+inactive, then no need to reinstall Tumbleweed per the current guidance. Also you can double check your version of xz to make sure it’s downgraded, the downgraded version for Tumbleweed should look like this:

    sudo zypper search -vi xz
    Loading repository data...
    Reading installed packages...
    
    S  | Name | Type    | Version               | Arch   | Repository
    ---+------+---------+-----------------------+--------+------------------
    i+ | xz   | package | 5.6.1.revertto5.4-3.2 | x86_64 | update-tumbleweed
        name: xz