[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAOp4FwSYdKgpQvuSQTXncnPAbgEuX0LJ4c_w9gorgp8FvhfY_A@mail.gmail.com>
Date: Fri, 6 Nov 2026 07:20:27 +0400
From: Loganaden Velvindron <loganaden@...il.com>
To: musl@...ts.openwall.com
Subject: Re: Advisory for OpenSSH+musl users
On Thu, 05 Nov 2026, 18:07 Rich Felker, <dalias@...c.org> wrote:
> Versions of OpenSSH prior to 10.6p2 using musl are affected by an
> authentication bypass when UsePAM=no and PasswordAuthentication=yes.
> Anyone who cannot immediately upgrade should edit /etc/ssh/sshd_config
> to set:
>
> PasswordAuthentication no
>
> and restart sshd after ensuring you have working pubkey access.
>
> Dropbear and other non-OpenSSH software using password-based logins is
> not affected. It is my position that this is not a bug in musl just an
> erroneous use by the caller. But the mechanism by which this happened
> is something we have been wanting to change for a while now, and it
> very likely will be changed in the upcoming release cycle.
>
> Details to follow soon.
>
Do you have the list of software which were breaking and which caused this
change in musl in the first place (commit:b3c4cc121f70f) ?
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
