[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAOp4FwQS5d5KrfrQ2gvFoFvYF=nm8Uux0kCCr17mj2jbO+k2Wg@mail.gmail.com>
Date: Fri, 6 Nov 2026 23:25:47 +0400
From: Loganaden Velvindron <loganaden@...il.com>
To: musl@...ts.openwall.com
Subject: Re: OpenSSH password auth bypass analysis [was: Re:
Advisory for OpenSSH+musl users]
On Fri, 6 Nov 2026 at 22:55, Rich Felker <dalias@...c.org> wrote:
>
> On Thu, Nov 05, 2026 at 10:07:13AM -0500, Rich Felker wrote:
> > Versions of OpenSSH prior to 10.6p2 using musl are affected by an
> > authentication bypass when UsePAM=no and PasswordAuthentication=yes.
> > Anyone who cannot immediately upgrade should edit /etc/ssh/sshd_config
> > to set:
> >
> > PasswordAuthentication no
> >
> > and restart sshd after ensuring you have working pubkey access.
> >
> > Dropbear and other non-OpenSSH software using password-based logins is
> > not affected. It is my position that this is not a bug in musl just an
> > erroneous use by the caller. But the mechanism by which this happened
> > is something we have been wanting to change for a while now, and it
> > very likely will be changed in the upcoming release cycle.
> >
> > Details to follow soon.
A lot of software has since fixed this and checked for null when
calling crypt().
A few software haven't been updated yet. e.g vsftp:
https://github.com/cyberstormdotmu/vsftpd/commit/c96590f9a4056dfe73a01c8f02df5a3674ed9111
I think I could submit a patch to remove this behaviour and return
NULL for failure ?
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
