Yes, indeed the backdoor code checks, in the event of ssh authentication with a certificate, that it was signed with a specific ssh private key (their own CA), the corresponding public key being hardcoded in the backdoor code.
But this project xzbot demonstrates how to patch the corrupted liblzma to replace the key
Oh thank you so much for these instructions I’ll go through them on my computer.
I indeed wanted to know if the versions were still downloadable anywhere but if you can still install the correct liblzma version on any version of the distribution that works. I tried on a Debian VM on mac but with too little knowledge and it never run the correct liblzma
xzbot from Anthony Weems enables to patch the corrupted liblzma to change the private key used to compare it to the signed ssh certificate, so adding this to your instructions might enable me to demonstrate sshing into the VM :)
Come out for free? You mean in the public domain? You’re gonna wait a long time here Also with with the rest of this comment
China is already communist
Agree Well I took a midlyinfuriating tone for this post that midlyinfuriated me I just hoped this bug could have been brought to the attention of mainteners in another way that with a post on this community, which can leave a different taste But now I’ll get back to not assuming people’s intentions based on the form only
Taking things for granted on an open-source software without willing to do anything
That looks just like the town Delft