Are AppImages affected by the XZ backdoor?

[alex-spataru]

Just yesterday, it was reported that a backdoor was discovered in versions 5.6.0 and 5.6.1 of the xz utils package, as detailed in this Ars Technica article. Considering that most of us developers create AppImages on older distributions, I believe the impact of this vulnerability may be mitigated. However, I also believe that it is better to ask than to assume. In light of this issue, should we review our build mechanisms to ensure the safety of our users? I welcome your thoughts and suggestions on this matter.

[TheAssassin]

Nope. The runtime uses a really old, hand-picked version of liblzma. Same goes for appimagetool.

[alex-spataru]

Thanks for the clarification!