diff options
author | Lasse Collin <lasse.collin@tukaani.org> | 2024-04-08 15:32:58 +0300 |
---|---|---|
committer | Lasse Collin <lasse.collin@tukaani.org> | 2024-04-09 17:57:39 +0300 |
commit | e93e13c8b3bec925c56e0c0b675d8000a0f7f754 (patch) | |
tree | 606eecef95eb881a9ec00220b65574786990027e /tests/files/good-1-riscv-lzma2-2.xz | |
parent | CMake: Fix sabotaged Landlock sandbox check. (diff) | |
download | xz-e93e13c8b3bec925c56e0c0b675d8000a0f7f754.tar.xz |
Remove the backdoor found in 5.6.0 and 5.6.1 (CVE-2024-3094).
While the backdoor was inactive (and thus harmless) without inserting
a small trigger code into the build system when the source package was
created, it's good to remove this anyway:
- The executable payloads were embedded as binary blobs in
the test files. This was a blatant violation of the
Debian Free Software Guidelines.
- On machines that see lots bots poking at the SSH port, the backdoor
noticeably increased CPU load, resulting in degraded user experience
and thus overwhelmingly negative user feedback.
- The maintainer who added the backdoor has disappeared.
- Backdoors are bad for security.
This reverts the following without making any other changes:
6e636819 Tests: Update two test files.
a3a29bbd Tests: Test --single-stream can decompress bad-3-corrupt_lzma2.xz.
0b4ccc91 Tests: Update RISC-V test files.
8c9b8b20 liblzma: Fix typos in crc32_fast.c and crc64_fast.c.
82ecc538 liblzma: Fix false Valgrind error report with GCC.
cf44e4b7 Tests: Add a few test files.
3060e107 Tests: Use smaller dictionary size in RISC-V test files.
e2870db5 Tests: Add two RISC-V Filter test files.
The RISC-V test files also have real content that tests the filter
but the real content would fit into much smaller files. A generator
program would need to be available as well.
Thanks to Andres Freund for finding and reporting it and making
it public quickly so others could act without a delay.
See: https://www.openwall.com/lists/oss-security/2024/03/29/4
Diffstat (limited to '')
-rw-r--r-- | tests/files/good-1-riscv-lzma2-2.xz | bin | 7432 -> 0 bytes |
1 files changed, 0 insertions, 0 deletions
diff --git a/tests/files/good-1-riscv-lzma2-2.xz b/tests/files/good-1-riscv-lzma2-2.xz Binary files differdeleted file mode 100644 index 60d2403a..00000000 --- a/tests/files/good-1-riscv-lzma2-2.xz +++ /dev/null |