Hi,

On 29/3/24 23:02,dng@??? wrote:

> For those running testing or unstable your are urged to update the
> xz-utils package:
> https://lists.debian.org/debian-security-announce/2024/msg00057.html
> Grtz.
> Nick

As explained in this thread:

https://www.openwall.com/lists/oss-security/2024/03/29/4

the backdoor is in upstream xz-utils/liblzma and leads to ssh server compromise.

"Openssh does not directly use xz-utils/liblzma. However debian and several other distributions
patch openssh to support systemd notification, and libsystemd does depend o xz-utils/liblzma"

Cheers,

Aitor.