[db48x]

Xz is an open–source compression program, as well as a library that can be used to help you write your own program that deals with compressed data. It is used by a fairly large number of other programs, one of which is OpenSSH. OpenSSH is an open–source program that allows remote users to access a computer, usually a server, provided they have the correct credentials (such as a valid password or encryption key).

Xx has a reasonably venerable history, and has passed from maintaner to maintainer several times in the past. A few years ago, a new maintainer stepped in to take the job. A few weeks ago he released a new version of the Xz library. This new version crashed a number of times when it was incorporated into Debian (an open–source Linux distribution of similar venerability). These crashes were investigated, and a back door was discovered.

The new version of Xz detects that it has been compiled in to OpenSSH and adds it's own code to the part of the program that checks the credentials of the user who is logging in. When an incoming connection is encrypted, the back door code checks the encrypted data for a message signed by the back–door’s author. If one is discovered, the the message is executed immediately, instead of logging anyone in. The allows anyone with the right key to secretly execute arbitrary instructions on the targeted computer, usually with full root access. Obviously that's not something the Debian or OpenSSH developers want included in their programs.

[1vuio0pswjnm7]

A nice example of why cannot trust "explanations" by HN commenters.

"It is used by a fairly large number of other programs, one of which is OpenSSH." <-- This is false

Have a look:

https://ftp.OpenBSD.org/pub/OpenBSD/OpenSSH/portable/openssh...

If a person compiles sshd from source using above source code, then there is no vulnerability. OpenSSH does not use xz/liblzma.

    wget https://ftp.OpenBSD.org/pub/OpenBSD/OpenSSH/portable/openssh-9.7p1.tar.gz
    tar xzf openssh-9.7p1.tar.gz
    cd openssh-9.7p1
    ./configure
    make install

Beware HN commenters/voters making false statements (and even trying to defend them against true statements).

[ksherlock]

"It is used by a fairly large number of other programs, one of which is OpenSSH. "

Not exactly. OpenSSH does not use xz. From the original report:

"openssh does not directly use liblzma. However debian and several other distributions patch openssh to support systemd notification, and libsystemd does depend on lzma."

[db48x]

True but irrelevant. I left out a lot of irrelevant details, because I was aiming for a simple explanation (if not quite one truly suited for a five–year–old).