[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <avGP3ZsVvX1mOirn@debian>
Date: Mon, 9 Nov 2026 11:10:56 +0100
From: Alejandro Colomar <alx+linux-man@...nel.org>
To: Walter Harms <wharms@....de>
Cc: "linux-man@...r.kernel.org" <linux-man@...r.kernel.org>,
Rich Felker <dalias@...c.org>, libc-alpha@...rceware.org, musl@...ts.openwall.com,
~hallyn/shadow@...ts.sr.ht
Subject: Re: RFC: how to document musl-crypt failure ?
Hi Walter,
> Date: 2026-11-09 08:59:19+0000
> From: Walter Harms <wharms@....de>
>
> Hello list,
> in case someone missed it: musl crypt() had an documented but
> unexpected behavier that caused a lot of trouble. See:
> <https://news.ycombinator.com/item?id=50377221> SSHHole.com CVE-2026-123158
Indeed, I also wondered if we should change something in the
documentation after it happened. Unfortunately, the bug has been
treated with some secrecy in the first days (reasonable), so I couldn't
really understand what went wrong.
I've CCed Rich and also musl and glibc, since they probably want to
comment. I've also CCd shadow-utils.
> Normaly i would step over it but in this special case ... it would
> like to start a discussion if we should mention that in a note to
> crypt().
Thanks!
> Perhaps recommending an additional check for '*' ? I am not sure but
> this is a very special case ...
Rich, now that some time has passed and I guess everyone has a patched
SSH, would you mind clarifying what happened, and what should be
documented about it?
Have a lovely day!
Alex
> CU
--
<https://www.alejandro-colomar.es>
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
