Format: 1.8
Date: Mon, 15 Apr 2024 14:15:02 -0700
Source: xz-utils
Binary: liblzma5 liblzma5-udeb xz-utils xzdec liblzma-dev liblzma-doc
Architecture: source
Version: 5.4.6-0ubuntu1~20.04.sav1
Distribution: focal
Urgency: medium
Maintainer: Jonathan Nieder <jrnieder@gmail.com>
Changed-By: Rob Savoury <savoury@savos.tech>
Description:
 liblzma-dev - XZ-format compression library - development files
 liblzma-doc - XZ-format compression library - API documentation
 liblzma5   - XZ-format compression library
 liblzma5-udeb - XZ-format compression library (udeb)
 xz-utils   - XZ-format compression utilities
 xzdec      - XZ-format compression utilities - tiny decompressors
Changes:
 xz-utils (5.4.6-0ubuntu1~20.04.sav1) focal; urgency=medium
 .
   * Response to CVE-2024-3094 backdoor (new upstream changes from April 2024):
     - d/patches/: Add cve-2024-3094-doc-changes-part{1,2,3}.patch (upstream)
         to show current correct maintainer and URL info (removes "Jia Tan")
       - Add cve-2024-3094-doc-changes-part4.patch to purge the evildoer from
         documentation in several additional files not yet changed by upstream
     - NOTE: No ifunc support was in any xz-utils source prior to v5.5.1alpha,
       and at this time all available information about CVE-2024-3094 says that
       the backdoor relied upon ifunc to operate, so this version 5.4.6 should
       not be vulnerable (and as soon as upstream makes a new release with all
       changes by "Jia Tan" removed that release will be published at the PPAs)
Checksums-Sha1:
 8777f1bb61fbeac9732ae9bc99128dd6881f38e4 2512 xz-utils_5.4.6-0ubuntu1~20.04.sav1.dsc
 4dc343f36088d0edc83aa76d74a172993331a655 31468 xz-utils_5.4.6-0ubuntu1~20.04.sav1.debian.tar.xz
Checksums-Sha256:
 ea3e85f45dc3f9c496927220e8fd818f8ce70a186c55f9fbb503123da18d6bb1 2512 xz-utils_5.4.6-0ubuntu1~20.04.sav1.dsc
 267f08ad30d61f459ca97a929b2e52d05fa444c457a5b97280f10298520bedc2 31468 xz-utils_5.4.6-0ubuntu1~20.04.sav1.debian.tar.xz
Files:
 dc3cfce60b41765404851628ea34db42 2512 utils optional xz-utils_5.4.6-0ubuntu1~20.04.sav1.dsc
 13fb7e6e69add8f1d6c45eb29aee0d2f 31468 utils optional xz-utils_5.4.6-0ubuntu1~20.04.sav1.debian.tar.xz