[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20261105150711.GW23438@brightrain.aerifal.cx>
Date: Thu, 5 Nov 2026 10:07:13 -0500
From: Rich Felker <dalias@...c.org>
To: musl@...ts.openwall.com
Subject: Advisory for OpenSSH+musl users
Versions of OpenSSH prior to 10.6p2 using musl are affected by an
authentication bypass when UsePAM=no and PasswordAuthentication=yes.
Anyone who cannot immediately upgrade should edit /etc/ssh/sshd_config
to set:
PasswordAuthentication no
and restart sshd after ensuring you have working pubkey access.
Dropbear and other non-OpenSSH software using password-based logins is
not affected. It is my position that this is not a bug in musl just an
erroneous use by the caller. But the mechanism by which this happened
is something we have been wanting to change for a while now, and it
very likely will be changed in the upcoming release cycle.
Details to follow soon.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
