Cyber ·
Oss-sec discussion on crypt() NULL return in musl libc and OpenSSH
Message dated 6 November 2026, posted to the oss-sec feed on 7 November, reports an audit of crypt() use on Linux, notes remaining problems, and suggests musl reconsider returning NULL on failure.
According to the oss-sec feed record, the message was sent on 6 November 2026, and the available text is an automatic translation. The author reports auditing crypt() use across the Linux ecosystem. In his account, most programs now handle a NULL return from this function, but some still have problems, with one example of a change request in a vsftpd repository. He suggests that musl libc reconsider returning NULL on failure and that maintainers check which programs still have problems. He also notes that the musl commit dates from 2012. The title mentions a password authentication bypass in OpenSSH with musl libc, but the available excerpt does not describe the technical mechanism or the impact, and the full analysis is not in the record.
Relevance for Rota Nacional: the subject is operating system and library infrastructure. Rota does not fix libraries, SSH servers or programs. If the reader uses AI to study this material, they should not paste keys, passwords, hashes, internal host names or real configurations. Remove credentials before any submission. To verify the information, consult the original oss-sec message, the musl commit history and the security notes of the distributions you use.
Original source: Re: “sshole”: desvio da autenticação por senha no OpenSSH com musl libc