Tagged “supply-chain”

Malicious backdoor in xz/liblzma (supply-chain compromise)

A backdoor was intentionally introduced into the xz-utils upstream release tarballs (5.6.0 / 5.6.1). When linked into sshd via liblzma, it allows a remote attacker holding a specific key to bypass authentication and execute commands.