671
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 29 Mar 2024
671 points (99.0% liked)
Technology
60047 readers
1493 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 2 years ago
MODERATORS
The library itself is very common and used by a lot of things (in this case it seems that the payload only activated when used by specific programs, like SSH).
What you can do about it is keep your system up-to-date using your distribution update mechanisms. This kind of thing, when found out, is usually fixed quickly in security updates. In Mint (which I don't use, but I believe is based on either debian or ubuntu, which uses dpkg/apt) security updates are flagged differently anc can be installed automatically, depending on your configuration.
tl;dr: keep your system up-to-date, it will keep known vulnerabilities away as much as it can;
In this case though the backdoor was added recently so updating could do the opposite of help here. Luckily I don't think any stable distros added the new version.
It was added recently, but at this point in the timeline, fixes are available for most mainstream distro at least. Except for rare cases where a fix can't be made available quickly, this kind of publicity is only done when a fix is broadly available. There are extreme cases of course, but in this case, it's fixed.
Thanks. I do my best to regularly update, so here's hoping it will not be a problem for me before an update fixes it!
Alternatively, if you never use ssh, then it wouldn't be a problem.
There are definitely times where (at least based on the instructions I read) that I have had to use ssh for various reasons, so I think it will be a problem in the future if I don't get a fix in an update. But I'm guessing a fix will be coming soon.