DomainKey-Signature: a=rsa-sha1; c=nofws; d=vk4msl.com; h=message-id
	:date:mime-version:subject:to:references:from:cc:in-reply-to
	:content-type:content-transfer-encoding; q=dns; s=gapmx; b=B3UAP
	ggf9MV8yl+1l3br8nopjrdL45M6+X7AhWMstlcIpsH7chTs84ldNtxC09tMA3+7S
	hpMR6P2QZM76hxtm1lUUqYEjFnAFFEIuKMopASA6iknEwqB15ejWokEkk5e64iM9
	W59A9f+NF3F77WeqOs4/gCCb+CZlf4d18f9JpuMre48Hou1sjyR37DkGeipoGPAo
	oa1TjUqcocdkRRO3dAakW0YCoq0NxISgBhJI8py7d9G2zrZCy8PElHP9pQSMnBnv
	dljJNpA4+LF3xbXRVjXewvlGfg8AquSiJ4t28F9CmVMTWV/eFCZirpE97uxA5VVq
	EijdDjPuCp6USZA/FOn6AXT6gGRZ9hSIow3Gqn26iNIhm8vSdGJhy7M1cbB0DrSM
	T7lBBfXzzV8KW5ZflhBlg0st7wzIy0c1ZUJ7qpU5CeDhIGoUfmVfCyfrNJ+xo8iv
	L9IuVE+Ru/zrqZH9d1V07pwGwivn1GiTGOZKoRAaEMQvxAFa3eiGFKLHcidej5MZ
	mRlRI8CurwbP0XzamjEmrRBPUqlEY3jPd6JbS+irpIv0ASxPipfAenWGZV75gEK+
	6R55ST/JQeTn8Ylpt0RjX0BtbooATHM01Gw4gPO0F9zrE6fRDfM3cB0QHFVA1njJ
	GSSM+ndS1/T6mbRnnltg9JPDOJMfzPfH1qskCk=
Message-ID: <9c66ab07-c48f-4735-a213-ac4935ba3f2e@vk4msl.com>
Date: Sun, 31 Mar 2024 07:25:28 +1000
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: XZ force downgrade led to removal of many packages
To: Ralf Mardorf <ralf-mardorf@riseup.net>
References: <1c614505-92f2-42b4-ba46-b227777e0d5b@lodispoto.com>
 <974c079f-8e90-495c-a9f8-c266eb458f09@vk4msl.com>
 <9950f380892dea7134b69901f5ee5f7c9283ca47.camel@riseup.net>
Content-Language: en-AU
From: Stuart Longland VK4MSL <me@vk4msl.com>
Cc: "~alpine/users@lists.alpinelinux.org"
 <~alpine/users@lists.alpinelinux.org>
In-Reply-To: <9950f380892dea7134b69901f5ee5f7c9283ca47.camel@riseup.net>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

On 30/3/24 20:39, Ralf Mardorf wrote:
> security through naivety is new to me.
> 
> For example, Arch uses systemd by default, but does not link openssh 
> directly to liblzma. Arch uses neither RPM nor DEB. From a naive
> point of view, Arch is not affected either.
> 
> "However, out of an abundance of caution, we advise users to remove
> the malicious code from their system by upgrading either way. This
> is because other yet-to-be discovered methods to exploit the backdoor
> could exist." - 
> https://lists.archlinux.org/archives/list/arch-announce@lists.archlinux.org/thread/MX363534MGK44R5UIYPK4GABKHF76TYC/

If possible.  Now, if you're running 3.19, according to
pkgs.alpinelinux.org, the latest release of xz is 5.4.5:

https://pkgs.alpinelinux.org/packages?name=xz*&branch=v3.19&repo=&arch=&maintainer=

Meaning, the vulnerable version *should not be present*.

The only way a vulnerable version could be there would be if someone
installed it from `edge`: the *unstable* distribution.  It comes with 
this warning:

> Warning: edge is under constant development so be careful using it in
> production. It is possible that bugs in edge could cause data loss or
> could break your system.
-- https://wiki.alpinelinux.org/wiki/Repositories#Edge

I'd imagine that those "bugs" can include security vulnerabilities. 
Especially those from upstream releases, which is what we have here. 
This isn't the fault of the AlpineLinux developers: few of us have the 
resources to manually inspect every release of every package for such 
vulnerabilities.  I've been there: I used to do it on the Mozilla and 
MIPS teams for Gentoo.

So it would seem for the OP, the options are:

1. roll back to release 3.19, which does not include the vulnerability
2. hold tight until a fixed release can trickle down from upstream

Regards,
-- 
Stuart Longland (aka Redhatter, VK4MSL)

I haven't lost my mind...
   ...it's backed up on a tape somewhere.