Recent versions of XZ (since 2022) may be compromised and should be checked

[Jaifroid]

I believe Kiwix may use a "frozen" version of XZ, but we should check that it isn't compromised by the recently discovered back door. See for example https://thehackernews.com/2024/03/urgent-secret-backdoor-found-in-xz.html and for a detailed timeline https://boehs.org/node/everything-i-know-about-the-xz-backdoor.

[kelson42]

@Jaifroid Thank you for this bug report, very interesting, at so much levels. Currently we distribute binaries with version 5.2.6 of libzma which has been published the 2022-08-12. Weaknesses have been introduced from 2023, so I guess we are not impacted.

[kelson42]

Official annoucement: https://tukaani.org/xz-backdoor/, only the 5.6.0 and 5.6.1 are impacted.