thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

mattdsteele

Paprika doesn't have their API documented, so this is me reverse-engineering it from an Android device

Live Demo

https://knowing-grain.glitch.me/

Code: https://glitch.com/edit/#!/knowing-grain

Sync

0xjac

Thank you for helping us test the new LDAP provider for Indico.

Below you will find instructions on how to install and use the example application for testing. While this is a very simple application, it uses the same code as Indico 2.0 to perform LDAP operations.

Testing this application with the LDAP server you use for Indico will allow us to catch LDAP related bugs before we release Indico 2.0 or Flask-Multipass.

Prerequisites

Flask-Multipass requires Python 2.7 or newer. You can test it using:

python --version

rlemon

geek-misandry

Typical reaction formulae for misandrists

####1. "Wow, just wow."

This is the #1 goto for misandrists. It discourages any actual logical discussion, and just implies that the person you are talking to is so ignorant that it is, somehow, totally impossible for you to hold any sort of fruitful discussion with them.

ThiefMaster

def undo_changes(after):
    root = dbi.getInstance().getDBConnection().root()
    db = root._p_jar.db()
    undo_data = [obj for obj in db.undoInfo(last=-1000) if obj['time'] >= after]
    for entry in undo_data:
        db.undo(entry['id'])
        dbi.commit()

pferreir

[alias]
  humiliate = "!sh -c 'RECIPIENTS=`git blame $0 -e -L $1 | sed \"s/.* (<\\(.*\\)> .*/\\1/\" | sort | uniq | paste -sd \",\" -` ; git blame $0 -L $1 | mail -s \"WTF is this?\" $RECIPIENTS;'"

MadaraUchiha

[**Please, don't use `mysql_*` functions in new code**](http://bit.ly/phpmsql). They are no longer maintained [and are officially deprecated](http://j.mp/XqV7Lp). See the [**red box**](http://j.mp/Te9zIL)? Learn about [*prepared statements*](http://j.mp/T9hLWi) instead, and use [PDO](http://php.net/pdo) or [MySQLi](http://php.net/mysqli) - [this article](http://j.mp/QEx8IB) will help you decide which. If you choose PDO, [here is a good tutorial](http://j.mp/PoWehJ).

Please, don't use mysql_* functions in new code. They are no longer maintained and are officially deprecated. See the red box? Learn about prepared statements instead, and use PDO or MySQLi - this article will help you decide which. If you choose PDO, here is a good tutorial.