[aimonster2]

So wait, if I did a find / -n 'liblzma*' and saw 5.4, I'm good? This is only 5.6 and 5.6.1, right?

[xorcist]

From what is publicly known at the moment, yes.

Note however that xzutils home page says that "versions 5.2.12, 5.4.3 and later have been signed with Jia Tan's OpenPGP key" so there would have been plenty more opportunities. We may just have seen the beginning. Whoever did this played the long game.

Also note that there was proposed patches by this compromised project maintainer to oss-fuzz and valgrind to avoid the detection of this backdoor.

[botanical]

The attacker had 750 previous commits; maybe it was all for this or maybe there are more vulnerabilities.