13

Ars Technica's March 30, 2024 Backdoor found in widely used Linux utility breaks encrypted SSH connections includes the following:

Several people, including two Ars readers, reported that the multiple apps included in the HomeBrew package manager for macOS rely on the backdoored 5.6.1 version of xz Utils. HomeBrew has now rolled back the utility to version 5.4.6. Maintainers have more details available here.

At the link in the block quote (titled "brew install xz installs the outdated version 5.4.6 instead of 5.6.1 #5243") there is talk about brew cleanup xz --prune=0, but I don't really understand the implications of everything there.

I may need to use brew to install a specific numerical Python package in about a week. Should I wait a few days for the dust to settle, or should I find a way to "clean up" or to uninstall and then reinstall Homebrew?

3
  • 6
    From the page linked from the quote: „To be clear: we don't believe Homebrew's builds were compromised (the backdoor only applied to deb and rpm builds) but 5.6.x is being treated as no longer trustworthy and as a precaution we are forcing downgrades to 5.4.6.“ Also, from looking at gynvael.coldwind.pl/?lang=en&id=782, it only seems to be relevant for Linux systems.
    – nohillside
    Mar 31 at 10:05
  • 2
    @nohillside: I believe your analysis is correct. One of the tricky bits about this backdoor is that the malicious actor inserted the code only into the distribution tarballs, so it does not show up in any reviews of the source code repository. Furthermore, the code which inserts the backdoor checks whether the build process is running as part of a distribution package build under RPM or dpkg with a clean environment (as usually on a build server), so it does not show up on manual builds or test builds either. It only gets inserted into packages that are built as part of an official Linux … Mar 31 at 19:53
  • 1
    … distribution package build on a build server. Mar 31 at 19:54

3 Answers 3

33

TL,DR: just run brew upgrade.

“Just upgrade” is almost always the right answer when a security vulnerability is announced. Distribution maintainers are often notified of vulnerabilities in advance, and even when they aren't, they usually react quicker than end-users. By the time you read a press article about a vulnerability, it's usually been patched by all mainstream distributions. And if it isn't, it's usually because the patching is difficult and you probably won't manage it on your own quicker than the distribution.

As an end-user of software, you typically only need to react to a vulnerability if you installed it manually through a channel that doesn't do updates. This is one of the reasons you should install software via an app store or package manager if possible.

Needing special commands was an emergency measure while the Homebrew maintainers reacted to the vulnerability announcement. Homebrew is very reactive and all you need to do now is upgrade normally. As I write this, brew upgrade xz downgrades xz from 5.6.1 to 5.4.6.

At this time, no vulnerability is known in xz 5.6.1 as distributed by Homebrew (the known vulnerability was only inserted during some builds), but the Homebrew maintainers have rolled back xz in case there was another, better hidden vulnerability.

7
  • 2
    What about Homebrew users who don't know what xz is? Should we just run brew upgrade or brew upgrade xz or run some other commands for specific apps? I have no idea what I've got installed that might depend on xz.
    – Mentalist
    Apr 1 at 5:43
  • 1
    "Distribution maintainers are often notified of vulnerabilities in advance, and even when they aren't, they usually react quicker than end-users.": mostly right for open source software ( Linux, FreeBSD, OpenBSD, Brew, MacPorts… ). But mostly false for proprietary software ( Μιcrοsοft, ΑppΙe, GοοgΙe, Oracle… ).
    – dan
    Apr 1 at 10:35
  • 1
    @Mentalist brew upgrade xz quickly upgrades just xz. Given that it's a separate program, there's no need to upgrade the packages that depend on it, but you can upgrade everything with brew upgrade. The only reason to do specifically brew upgrade xz is if you're in a hurry. (Note that this would be different if there had been a backdoor: the backdoor could have been triggered during installation or normal use, and then it wouldn't be enough to just remove the backdoored code, you might also need to clean up the infection.) Apr 1 at 12:09
  • 1
    @dan Maintainers of proprietary software do typically receive notifications of vulnerabilities discovered by third parties, and release updates before the vulnerability becomes public. 90 days from notification to publication is standard in the industry, less for really bad vulnerabilities that affect a lot of people (e.g. a misconfigured web service), more for really hard to fix vulnerabilities (e.g. in hardware). Apr 1 at 12:11
  • 2
    i rarely if ever run brew upgrade and i just checked and found my xv version was already 5.4.6 so uh... not upgrading for the win?
    – Michael
    Apr 2 at 11:51
1

TLDR

brew cleanup xz --prune=0
brew upgrade xz

The other answers didn't work for me: brew upgrade xz did nothing until after I first ran brew cleanup xz --prune=0.

brandon@Air ~ % brew upgrade xz              
Warning: xz 5.6.1 already installed
brandon@Air ~ % brew remove xz
Error: Refusing to uninstall /opt/homebrew/Cellar/xz/5.6.1
because it is required by aom, asciinema, awscli, bfg, bpytop, crystal, curl, fftw, gcc, gd, gdk-pixbuf, ghostscript, glib, graphviz, gts, harfbuzz, hdf5, imagemagick, jpeg-xl, libarchive, libavif, libheif, libmatio, libmng, libraw, librsvg, libtiff, libzip, little-cms2, llvm, llvm@15, llvm@16, mackup, maven, neovim-qt, netpbm, open-mpi, openjdk, openjpeg, openslide, pango, pgcli, poppler, postgresql@15, px, [email protected], [email protected], [email protected], [email protected], qt, ranger, rust, the_silver_searcher, tldr, vim, vips, webp, xxh, zig and zstd, which are currently installed.
You can override this and force removal with:
  brew uninstall --ignore-dependencies xz
brandon@Air ~ % brew cleanup xz --prune=0 
Warning: Skipping (old) /opt/homebrew/Cellar/xz/5.6.1 due to it being linked
Removing: /opt/homebrew/Cellar/xz/5.4.6... (163 files, 2.6MB)
Removing: /Users/brandon/Library/Caches/Homebrew/xz_bottle_manifest--5.4.6... (7.5KB)
Removing: /Users/brandon/Library/Caches/Homebrew/xz_bottle_manifest--5.6.1... (7.5KB)
Removing: /Users/brandon/Library/Caches/Homebrew/xz--5.6.1... (688.7KB)
==> This operation has freed approximately 3.3MB of disk space.
brandon@Air ~ % brew upgrade xz 
==> Upgrading 1 outdated package:
xz 5.6.1 -> 5.4.6
...
...
...
0

So far, there has been no security advisory from the brew project. Nor are there any open issues against xz.

If the risk has not been documented and addressed by the time you need the packages, install the numerical Python packages without brew.

4
  • 2
    You're looking in the wrong place. From your first link "The following do not constitute security vulnerabilities in Homebrew: security vulnerabilities in packaged software that are present in the upstream software". Thus any advisory would come from XZ Utils directly and not Homebrew.
    – user71659
    Apr 1 at 20:14
  • The question concerns the use of brew and installing python packages. This answer focuses on answering the original question – and not a broader discussion of the ongoing xz incident. Apr 2 at 6:04
  • 7
    So what? The first paragraph is still completely misleading. Brew will not post any security advisory or accept any issues against xz as the issue is upstream. This is clearly stated in the policy you linked.
    – user71659
    Apr 2 at 18:58
  • Given the concerns of the questioner, this answer is an appropriate and actionable answer. Apr 3 at 9:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .