Cyber ·
Comment on the oss-sec list about password authentication bypass in OpenSSH and musl libc
A comment published on November 5 on the oss-sec list discusses how differences in hash handling can create a side channel or timing attack in the sshole case involving OpenSSH and musl libc.
This item is a machine translation of a comment posted to the oss-sec mailing list, dated November 5, in a thread titled sshole, about a password authentication bypass in OpenSSH that involves musl libc. The author states that the comment is general and does not fit well with every discussion of the case. According to the text, using a single asterisk character or a shorter string of random characters so that hashes do not match likely creates the conditions for a side channel or timing attack. The author also says cryptographic routines should run in as constant a time as possible, and that early exit caused by different string lengths provides the side channel. The text received is truncated and gives no details on affected versions or fixes. To consult and verify, find the original thread on the 2026 oss-sec list, read the full comment, and check official advisories from the OpenSSH and musl projects and your distribution.
Original source: Re: “sshole”: desvio da autenticação por senha no OpenSSH + musl libc