There has been much activity in the Linux community recently since it was discovered that some XZ tarballs had malicious code hidden in them. As a result, Debian devs have decided to delay the launch of the 12.6 release until they can fully understand how widespread the issue is and how much damage the bad code might have done.
Currently, is no straightforward way to determine if a system has been compromised due to this vulnerability. Vegard Nossum wrote a script, โdetect_sh.bin,โ to detect if itโs likely that the ssh binary on a system is vulnerable. The script can be found here (at the end of the publication). However, its use is more for informational purposes.
In other words, the absence of reliable detection methods at the moment further emphasizes the importance of prompt action by users to secure their systems. And openSUSE Tumbleweed was quick to approach the problem quite decisively.
If you use this fantastic rolling-release distribution, youโll be amazed that around 2000 updates are ready for you today. Thatโs correct – openSUSE Tumbleweed has rebuilt its whole codebase and every package.
Of course, the number of packages varies according to each installation. Yes, downloading and installing such extensive updates may seem daunting to many users.
However, it is necessary to ensure the security and integrity of usersโ systems. By rebuilding the entire codebase against a known uncompromised version of the XZ library, openSUSE aims to safeguard its users against potential breaches and maintain the trustworthiness of its distribution.
Additionally, suppose you use the Plasma desktop and havenโt updated your computer since Plasma 6 was added to the Tumbleweed repositories in the last two weeks. In that case, itโs a good idea to update in a different way than usual. Instead of updating while youโre in the desktop environment, do it through a virtual terminal.
Here’s how: Press “CTRL+ALT+F4” to switch to a virtual console, and then use the usual commands listed below to update your system.
sudo zypper ref
sudo zypper dup
