Cyber ·
oss-sec discussion: crypt() return values and password authentication in OpenSSH with musl
A comment posted to the oss-sec list on November 5, 2026 discusses how Debian documented crypt() and a possible bypass of password authentication in OpenSSH with musl libc. The excerpt does not detail the exploitation conditions.
The oss-sec feed item, shown through automatic translation, was published on November 6, 2026 (UTC) and contains a reply about a password authentication bypass in OpenSSH and musl libc. The message itself indicates publication on November 5. The author states that, before roughly 2019, when OpenSSH was changed, Debian displayed a manual page documenting only a NULL return on crypt() errors.
The excerpt quotes the crypt() manual page, which says that on success a pointer to the hashed password is returned and on error NULL is returned. The comment also notes that changing system APIs is problematic. The available text is truncated and does not present the full technical analysis or any exploitation proof, so the scope of the issue cannot be confirmed from it.
For administrators, the practical lesson is to check the installed OpenSSH and C library versions, the vendor patches, and the documentation for the version in use, rather than treating an older manual page as definitive. Rota Nacional does not fix OpenSSH or musl libc and does not solve this engineering problem.
To consult the source, open the original record in the November 2026 oss-sec list and the cited manual pages, then compare the described behavior with your distribution.
Original source: Re: “sshole”: desvio da autenticação por senha no OpenSSH + musl libc