A backdoor in xz

Further analysis posted to the mailing list after this short blurb was released to LWN suggest this isn't a authentication bypass backdoor. It's in reality an RCE back door triggered by sending a particular security certificate to the compromised system's sshd.

A resulting bug report was sent to OpenSSH to close the potentially unwanted authentication vector that makes the RCE possible. https://bugzilla.mindrot.org/show_bug.cgi?id=3675

It seems as if OpenSSH will accept a security cert regardless of whether a CA is configured or not.

Otherwise, it seems this backdoor in xz was still limited to certain kinds of Linux environments and was (accidentally) caught before it could do widespread damage. Where FOSS project security goes from here will largely be up to the individuals and individual organizations that manage them. Hopefully, it will lead to greater scrutiny of individual project governance's standards (like how thoroughly they have been reviewing commits) before inclusion into others (like Linux distro repositories).