[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20261106025704.GY23438@brightrain.aerifal.cx>
Date: Thu, 5 Nov 2026 21:57:04 -0500
From: Rich Felker <dalias@...c.org>
To: Rob Landley <rob@...dley.net>
Cc: musl@...ts.openwall.com
Subject: Re: Advisory for OpenSSH+musl users
On Thu, Nov 05, 2026 at 07:16:28PM -0600, Rob Landley wrote:
> On 11/5/26 09:07, Rich Felker wrote:
> > Dropbear and other non-OpenSSH software using password-based logins is
> > not affected.
>
> Specifically versions of dropbear from 2019 onward aren't affected.
>
> https://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2026q4/002402.html
>
> Really old versions were susceptible.
Even old dropbear versions weren't affected:
https://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2026q4/002403.html
I think the source of the claim was a misunderstanding that musl was
doing something very bad, like crypt(pass,"*")=="*". This is not the
case. crypt(pass,"*") yields "x". This is similar to the "*0"/"*1"
libxcrypt uses, just with different names.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
