this post was submitted on 03 Apr 2024
35 points (88.9% liked)
Nix / NixOS
2326 readers
1 users here now
Main links
Videos
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
That works for leaf packages but not for core node packages. Every package depends on xz in some way; it's in the stdenv aswell as bootstrap.
Those packages themselves depend on xz. Pretty much all of them.
What you're suggesting would only make the
xzexecutable not be backdoored anymore but any other application using liblzma would still be as vulnerable as before. That's actually the only currently known attack vector; inject malicious code into SSHD via liblzma.