MIME-Version: 1.0
References: <1c614505-92f2-42b4-ba46-b227777e0d5b@lodispoto.com>
 <974c079f-8e90-495c-a9f8-c266eb458f09@vk4msl.com> <9950f380892dea7134b69901f5ee5f7c9283ca47.camel@riseup.net>
 <9c66ab07-c48f-4735-a213-ac4935ba3f2e@vk4msl.com>
In-Reply-To: <9c66ab07-c48f-4735-a213-ac4935ba3f2e@vk4msl.com>
Reply-To: noloader@gmail.com
From: Jeffrey Walton <noloader@gmail.com>
Date: Sat, 30 Mar 2024 20:48:53 -0400
Message-ID: <CAH8yC8nq0eaF5mMxTgYYGH4vDj1m4x_f+OYG_1ZzN4Bfkq5aPg@mail.gmail.com>
Subject: Re: XZ force downgrade led to removal of many packages
To: Stuart Longland VK4MSL <me@vk4msl.com>
Cc: Ralf Mardorf <ralf-mardorf@riseup.net>, 
	"~alpine/users@lists.alpinelinux.org" <~alpine/users@lists.alpinelinux.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Sat, Mar 30, 2024 at 5:26=E2=80=AFPM Stuart Longland VK4MSL <me@vk4msl.c=
om> wrote:
>
> On 30/3/24 20:39, Ralf Mardorf wrote:
> > security through naivety is new to me.
> >
> > For example, Arch uses systemd by default, but does not link openssh
> > directly to liblzma. Arch uses neither RPM nor DEB. From a naive
> > point of view, Arch is not affected either.
> >
> > "However, out of an abundance of caution, we advise users to remove
> > the malicious code from their system by upgrading either way. This
> > is because other yet-to-be discovered methods to exploit the backdoor
> > could exist." -
> > https://lists.archlinux.org/archives/list/arch-announce@lists.archlinux=
.org/thread/MX363534MGK44R5UIYPK4GABKHF76TYC/
>
> If possible.  Now, if you're running 3.19, according to
> pkgs.alpinelinux.org, the latest release of xz is 5.4.5:
>
> https://pkgs.alpinelinux.org/packages?name=3Dxz*&branch=3Dv3.19&repo=3D&a=
rch=3D&maintainer=3D

Jia Tan started contributing to xz circa the development version 5.3.
To get untainted code, you have to go back to version 5.2. But rolling
back to version 5.2 means ABI and symbol breaks. If you don't want to
go back to 5.2, then it means you have to audit over 700 commits in
xz. Also see <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D1068024#5=
>.

Maybe worth mentioning... Jia Tan also compromised libarchive. See
<https://github.com/libarchive/libarchive/pull/1609>.

> Meaning, the vulnerable version *should not be present*.
>
> The only way a vulnerable version could be there would be if someone
> installed it from `edge`: the *unstable* distribution.  It comes with
> this warning:
>
> > Warning: edge is under constant development so be careful using it in
> > production. It is possible that bugs in edge could cause data loss or
> > could break your system.
> -- https://wiki.alpinelinux.org/wiki/Repositories#Edge
>
> I'd imagine that those "bugs" can include security vulnerabilities.
> Especially those from upstream releases, which is what we have here.
> This isn't the fault of the AlpineLinux developers: few of us have the
> resources to manually inspect every release of every package for such
> vulnerabilities.  I've been there: I used to do it on the Mozilla and
> MIPS teams for Gentoo.
>
> So it would seem for the OP, the options are:
>
> 1. roll back to release 3.19, which does not include the vulnerability
> 2. hold tight until a fixed release can trickle down from upstream

Jeff