Inwieweit widerspricht das der Fedora-Meldung?
"The modified packages were only installed on a small number of Fedora
infrastructure systems, and therefore we do not believe Fedora account
holders were at significant risk during the time the intruder had
these packages in place. We also required passphrase and SSH key
changes from Fedora users, to increase our confidence going forward."