https://seclists.org/oss-sec/2026/q4/536: "sshole": password authentication bypass: OpenSSH + musl libc

Published Nov 6, 2026

Updated

Affected Software

2 affected components

OpenBSD OpenSSH

musl musl libc

Frequently Asked Questions

Is a crypt(3) return value of "*" a portable way to identify an authentication failure?

No. The discussion notes that "*" may be returned on error, while crypt(3) error behavior is not well standardized across implementations.

Which crypt(3) error behaviors need to be handled safely?

Implementations may return a null pointer or a fixed string on error, and most do not set errno. POSIX specifies a null return with errno set only for the case where crypt is unsupported.

Does the provided information identify affected OpenSSH or musl libc versions, default configurations, or a workaround?

No. The provided excerpt does not specify affected versions, whether default configurations are affected, or mitigation steps when patching is unavailable.

https://seclists.org/oss-sec/2026/q4/536: "sshole": password authentication bypass: OpenSSH + musl libc

Affected Software

Frequently Asked Questions

Is a crypt(3) return value of "*" a portable way to identify an authentication failure?

Which crypt(3) error behaviors need to be handled safely?

Does the provided information identify affected OpenSSH or musl libc versions, default configurations, or a workaround?

Company

Resources

Contact

Frequently Asked Questions

Is a crypt(3) return value of "*" a portable way to identify an authentication failure?

Which crypt(3) error behaviors need to be handled safely?

Does the provided information identify affected OpenSSH or musl libc versions, default configurations, or a workaround?