oss-sec mailing list archives

Re: "sshole": password authentication bypass: OpenSSH + musl libc

From: Vincent Lefevre <vincent () vinc17 net>
Date: Fri, 6 Nov 2026 01:02:43 +0100

On 2026-11-05 23:10:52 +0000, lists () notatla org uk wrote:

Upon error, crypt_r, crypt_rn, and crypt_ra write an invalid hash
to  the  output field of their data argument, and crypt writes an


If an error string is output does not : or multiple :: better
express the aim of never seeing this as field content
(because it is field separator) ?


Perhaps, but in any case, it is up to the application to check
error conditions, in particular that the result contains only
valid characters.

-- 
Vincent Lefèvre <vincent () vinc17 net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)

Current thread:

"sshole": password authentication bypass: OpenSSH + musl libc Jan Schaumann (Nov 05)
- Re: "sshole": password authentication bypass: OpenSSH + musl libc Loganaden Velvindron (Nov 05)
  - Re: "sshole": password authentication bypass: OpenSSH + musl libc Vincent Lefevre (Nov 05)
    - Re: "sshole": password authentication bypass: OpenSSH + musl libc lists (Nov 05)
    - Re: "sshole": password authentication bypass: OpenSSH + musl libc Vincent Lefevre (Nov 05)
    - Re: "sshole": password authentication bypass: OpenSSH + musl libc Michael Orlitzky (Nov 05)