Linux 上广泛使用的无损压缩软件包 xz-utils 被该项目的一位维护者秘密植入了后门，后门旨在绕过签名验证未经授权访问开放 SSH 端口的系统。存在后门的版本是 v5.6.0 和 v5.6.1，后门版本尚未进入 Linux 发行版的生产版本，因此影响范围有限，主要影响的是测试版本的 Debian 和 Red Hat 发行版，以及 Arch 和 openSUSE 等。攻击者被认为处心积虑，潜伏长达三年时间。使用中文拼音的攻击者 JiaT75 (Jia Tan) 于 2021 年创建了 GitHub 账号，之后积极参与了 xz-utils 的开发，获取信任之后成为了该项目的维护者之一。过去几个月，JiaT75 开始非常巧妙的悄悄加入恶意代码，“分阶段通过添加测试用例数据为掩盖放入了恶意代码，并在发布时在m4脚本的目录中添加了一些精妙的把恶意代码重新组装、解压缩的脚本，在库中添加了劫持某 OpenSSL 函数的功能，添加了一个 SSH 后门。”创建后门版本之后 JiaT75 还积极联络主要 Linux 发行版维护者，以该版本包含“很棒新特性”为由督促他们使用后门版本。

**曳尾于涂** · Mar 30, 2024, 10:00

曳尾于涂 boosted

**Xizu** @xizu0214@m.cmx.im · Mar 30, 2024, 10:00

Mar 30, 2024, 10:00

Xizu @xizu0214@m.cmx.im

最好的眼睛布是T恤的衣角

**曳尾于涂** · Mar 30, 2024, 10:10

曳尾于涂 boosted

愛知 @pch_xyz@seediqbale.xyz · Mar 30, 2024, 10:10

Mar 30, 2024, 10:10

愛知 @pch_xyz@seediqbale.xyz

YouTube 做了什麼改變，所有的 Invidious 站台都受影響
Title: The video returned by YouTube isn't the requested one. (Android client) (VideoNotAvailableException)
Date: 2024-03-30T10:05:32Z
Route: /watch?v=BL6Mi-A_FbU
Version: 2024.03.08-99a5e9cb @ master

The video returned by YouTube isn't the requested one. (Android client) (VideoNotAvailableException) from /usr/share/crystal/src/hash.cr:1080:49 in 'try_fetch_streaming_data' from src/invidious/videos/parser.cr:112:10 in 'extract_video_info:video_id' from /usr/share/crystal/src/hash.cr:1185:13 in 'fetch_video' from src/invidious/videos.cr:379:13 in 'get_video:region' from src/invidious/routes/watch.cr:55:15 in 'handle' from lib/kemal/src/kemal/route.cr:13:9 in '->' from src/invidious/helpers/handlers.cr:30:37 in 'call' from /usr/share/crystal/src/http/server/handler.cr:30:7 in 'call' from /usr/share/crystal/src/http/server/handler.cr:30:7 in 'call_next' from lib/kemal/src/kemal/filter_handler.cr:21:7 in 'call' from /usr/share/crystal/src/http/server/handler.cr:30:7 in 'call' from /usr/share/crystal/src/http/server/handler.cr:30:7 in 'call_next' from src/invidious/helpers/handlers.cr:94:12 in 'call' from /usr/share/crystal/src/http/server/handler.cr:30:7 in 'call' from /usr/share/crystal/src/http/server/handler.cr:30:7 in 'call' from /usr/share/crystal/src/http/server/handler.cr:30:7 in 'call_next' from src/ext/kemal_static_file_handler.cr:106:14 in 'call' from /usr/share/crystal/src/http/server/handler.cr:30:7 in 'call' from /usr/share/crystal/src/http/server/handler.cr:30:7 in 'call' from /usr/share/crystal/src/http/server/handler.cr:30:7 in 'call' from /usr/share/crystal/src/http/server/request_processor.cr:51:11 in 'handle_client' from /usr/share/crystal/src/fiber.cr:146:11 in 'run' from ???