[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <219F81BA-74ED-42BD-BCC8-58BAEE8AFF2C@gmail.com>
Date: Fri, 06 Nov 2026 12:08:15 +0900
From: Seo Suchan <tjtncks@...il.com>
To: musl@...ts.openwall.com
Subject: Re: Advisory for OpenSSH+musl users
Musl accepts invalid salts, and it uses fallback to des for any unknown salts so I think it default to making a full form des password hash. It doesn't matter because it won't match with "*" or "x" though.
On 2026년 11월 6일 오전 11시 57분 4초 GMT+09:00, Rich Felker <dalias@...c.org> 작성함:
>On Thu, Nov 05, 2026 at 07:16:28PM -0600, Rob Landley wrote:
>> On 11/5/26 09:07, Rich Felker wrote:
>> > Dropbear and other non-OpenSSH software using password-based logins is
>> > not affected.
>>
>> Specifically versions of dropbear from 2019 onward aren't affected.
>>
>> https://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2026q4/002402.html
>>
>> Really old versions were susceptible.
>
>Even old dropbear versions weren't affected:
>
>https://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2026q4/002403.html
>
>I think the source of the claim was a misunderstanding that musl was
>doing something very bad, like crypt(pass,"*")=="*". This is not the
>case. crypt(pass,"*") yields "x". This is similar to the "*0"/"*1"
>libxcrypt uses, just with different names.
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
