systemd: *does not have vulnerability*
openssh: *does not have vulnerability*
xz: *has extremely specific vulnerability*
out-of-tree downstream patch for openssh: *enables vulnerability to be exploited*

devuan guy in my mentions: this is systemd's fault