Re: [gentoo-user] Re: [gentoo-dev] Current unavoidable use of xz utils in Gentoo

[Daniel Frey <djqfrey@gmail.com>]

On 3/31/24 07:59, Michael wrote:
> On Sunday, 31 March 2024 13:33:20 BST Rich Freeman wrote:
>> (moving this to gentoo-user as this is really getting off-topic for -dev)
> 
> Thanks for bringing this to our attention Rich.
> 
> Is downgrading to app-arch/xz-utils-5.4.2 all that is needed for now, or are
> we meant to rebuilding any other/all packages, especially if we rebuilt our
> @world only a week ago as part of the move to profile 23.0?

I just ran `glsa-check -l affected` and it came up blank for me.

I ran `emerge --sync` and checked again and it indeed says my machine is 
affected.

I then ran `emerge -auDN world` and it automatically downgraded.

So, all we need to do sync and update world. It will downgrade xz-utils 
automatically.

If you want to make sure, run `glsa-check -l affected` after the emerge 
world, if it comes up blank you are not affected. Or run `glsa-check -l 
202403-02` and it will tell you if you are affected:

$ glsa-check -l 202403-04
[A] means this GLSA was marked as applied (injected),
[U] means the system is not affected and
[N] indicates that the system might be affected.

202403-04 [U] XZ utils: Backdoor in release tarballs ( app-arch/xz-utils )


Dan