on the openbsd sideno version of the openbsd base system includes xzthere is a version of it in p...

on the openbsd side

• no version of the openbsd base system includes xz

• there is a version of it in ports and a package available over pkg, and while a patch to update it to an affected version exists (https://marc.info/?l=openbsd-ports&m=171074964707308&w=2), it wasnt merged (let alone acknowledged prior to the backdoor being discovered)

• the scripts used to activate the backdoor dont actually work on a openbsd host (partly cause they explicitly abort when uname doesnt return “Linux”, partly because the -c option for the head and tail commands used to obfuscate the stage 1 script is a gnu extension openbsd does not support)

• openbsd does not include the openssh/systemd-integration patches that the backdoor targets due to not using systemd or any of the other pieces of software the backdoor relies on meaning it would not work even if you forcibly compiled it in yourself

conclusion: completely unaffected

RE: https://mastodon.bsd.cafe/users/stefano/statuses/112183457559624786