Good news - Clear Linux didn't have openssh linked to libzma, so not affected by the backdoored xz-utils. Today's release 41370 has rolled back the version of xz-utils to 5.4.6, and starting with release 41380 we're going to be stripping xz out of the OS wherever we can.