Repository navigation
[liblzma] port uses compromised version #37839
Description
Describe the bug
vcpkg updated liblzma to 5.6.0. This version is known as compromised and backdoored
https://nvd.nist.gov/vuln/detail/CVE-2024-3094
https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
This is a solid 10.0 CVE score vulnerability
vcpkg should immediately revert from 5.6.0
Activity
Revert [liblzma] update to version 5.6.0 (#37199) (#37841)
MichaelCurrie commentedon Mar 30, 2024
This PR already addresses the issue by downgrading xz version, but it still leaves the build broken because the entire xz repo has been disabled by GitHub so ALL versions are blocked.
So, to fix your build, run
git pullto sync that fix, and then make this unofficial one-liner change to grab xz from an unofficial mirror.Then building will work again:
carsten-grimm commentedon Mar 30, 2024
If you are using vcpkg in manifest mode with a builtin baseline, you can use an overlay port to implement the suggestion by Michael B. Currie (@MichaelCurrie) .
dg0yt commentedon Mar 30, 2024
... until that fork is taken down for the same reasons as the official repo.
carsten-grimm commentedon Mar 30, 2024
Yes. I am sure the folks involved do not make these decisions lightly. I hope there will be an actual solution soon.
Neustradamus commentedon Mar 30, 2024
The official XZ team announcement is here:
Important to know: There is no problem with contributors here like Dr.-Ing. Carsten Grimm (@carsten-grimm).
But several people mix all because I have requested the XZ update in vcpkg.
I have received a lot of bad messages (private and public).
I have no link with XZ project, I follow only the project and do announcement or/and update requests.
I have requested 5.4.5 and 5.6.0 because there was only 5.4.4 in vcpkg.
Gowtham (@gowthamgts) has participated on Reddit against me badly and I have commented on two places where he has commented (on my SCRAM request publications):
You can look here the original comment:
You can follow my announcements here:
The good point, people speak about SCRAM "Salted Challenge Response Authentication Mechanism" security ;)
Badly, some people or projects like only old unsecure mechanisms, some would like security improvements.
Include SDL 2.30.1 and link to Rust project for Windows development
[-]liblzma port uses compromised version[/-][+][liblzma] port uses compromised version[/+]Add WebSockets build dependency to Linux, Windows
Temporarily skip arrow, aws and iceberg builds due to xz / liblzma pr…
Temporarily skip arrow, azure and iceberg builds due to liblzma problems
liblzma patch overriding via bminor/xz
vcpkg: Replaced lzma port.
vcpkg: Replaced lzma port.
vcpkg: Replaced lzma port.
vcpkg: Replaced lzma port.
blessio commentedon Apr 3, 2024
You may have to not only reinstall the library as explained in the above (THANKS! Michael B. Currie (@MichaelCurrie)). But also:
How do I safely clean vcpkg archives and disable it? #14157 ( on windows this is to delete C:\Users\AppData\Local\vcpkg\archives - on other platforms please search the internet )
portfile.cmakeas explained above in all subfolders of VCPKG_ROOT\buildtrees\versioning_\versions\liblzma\[liblzma] Workaround source repo having been disabled (microsoft#37893)
build: hotfix for vcpkg build error due to dead xz repository URL
[liblzma] Workaround source repo having been disabled (microsoft#37893)
[liblzma] Workaround source repo having been disabled (microsoft#37893)
[liblzma] Workaround source repo having been disabled (microsoft#37893)
Updated VCPKG commit to reflect latest xz changes
Note xz workaround in Windows build instructions
build: hotfix for vcpkg build error due to dead xz repository URL
Neustradamus commentedon May 31, 2024
Theodore Tsirpanis (@teo-tsirpanis) has done a PR about the new XZ version (5.6.2) here:
cc: Dr.-Ing. Carsten Grimm (@carsten-grimm).
Linked to:
Official XZ links: