Cyber ·
oss-sec discussion on NULL return from crypt() and password authentication in OpenSSH with musl libc
A participant on the oss-sec list argues that applications that do not check a NULL return from crypt() should fail, and comments on changes to system APIs. The text is a machine translation of a message dated 6 November 2026.
The message, posted to the oss-sec mailing list on 6 November 2026, replies to a thread about password authentication bypass in OpenSSH with musl libc. It quotes a comment that, before the OpenSSH change around 2019, Debian would show a different manual page documenting only NULL as the error return. The reply says that changing system APIs is problematic and that applications that do not check for a NULL pointer should fail. The source is a machine translation and gives no further technical details, such as affected versions or published fixes.
For system administrators, the practical point is to review your own code that calls crypt() and confirm that a NULL return is handled. Rota Nacional does not fix system libraries or solve the engineering problem described. If you use AI to study this material, do not paste real passwords, hashes, keys, internal host names or configuration snippets. The platform detects personal data before any model runs and applies your organization's policy, but care from the user remains essential. Check the facts in the original message in the public oss-sec archive.
Original source: Re: “sshole”: desvio da autenticação por senha no OpenSSH com musl libc