The 9-year-old musl crypt() bug that let disabled openssh accounts take any long password
cramforce · x · 2026-11-05
A deep-dive from sshhole.com explains a problem in openssh on musl libc (Alpine, OpenWrt, buildroot, yocto, many Docker images) since 2016: accounts that should never accept a password (root, key-only deploy users, LDAP users, default Alpine cloud users) accept any password longer than 256 characters. The piece traces the history from Bill Joy's 1980 placeholder in /etc/passwd, through /etc/shadow salted hashing, to the POSIX rule that crypt() returns NULL on failure — and musl's 2012 change to return a single character instead, which programs never expect.
More from Safety
- OpenAI researcher: an AI security 'race to the top' is driving CVE disclosures — Eric_Wallace_ · 2026-11-06
- AI ethics researcher claims lab insiders coldly weigh catastrophe deaths against 'abundance' — LuizaJarovsky · 2026-11-06
- Firecracker VM escape disclosed: researchers claim root execution on the host — moyix · 2026-11-06
- Mustafa Suleyman flags 'deeply concerning' Delaware proposal for AI-run companies — mustafasuleyman · 2026-11-06
- Hugging Face open-sources safeagents, a local proxy that blocks reward-hacking tool calls — yb2698 · 2026-11-06
- Pinokio 8.3.7 ships security-first architecture after eMudhra certificate breach — cocktailpeanut · 2026-11-06