[solved] CVE-2024-3094 (xz backdoor): security measurements

[jpsollie]

Hello everyone,

My laptop/desktop/NAS have been using the xz-utils 5.6.0 package right from the start.
As such, they were potentially affected.
When this CVE was published, I immediately downgraded XZ, but:

1. Does it affect openssh binaries compiled with XZ as well? or only at runtime?
the idea is: let's assume I compiled a gentoo package for amd devices when xz 5.6.0 was being used,
will installing that precompiled binary automatically install the backdoor as well?

2. How can I activate the kill switch?
I read here: https://piaille.fr/@zeno/112185928685603910 that the following kill switch exists:

[pjp]

XZ utils: Backdoor in release tarballs — GLSA 202403-04

General discussion:
The xz package has been backdoored
_________________
Quis separabit? Quo animo?

[jpsollie]

all right, I'll close the topic here and ask in general discussion, thanks!
_________________
The power of Gentoo optimization (not overclocked): [img]https://www.passmark.com/baselines/V10/images/503714802842.png[/img]