[afnog] A perspective about the *SSHOLE vulnerability (and how we Africans can help contribute ?)

[Loganaden Velvindron]

Several of Project stormwing members sat on a Friday night discussing
this security issue.

*SSHOLE vulnerability concerns OpenSSH allowing password
authentication on Alpine Linux due to a specific build configuration
issue.

This issue affects Linux systems with musl-libc.
The issue can be traced back to a commit in 2012 which returned *
instead of NULL on failure due to incorrect usage of crypt(). This
isn't POSIX compliant behaviour.

https://git.musl-libc.org/cgit/musl/commit/?id=b3c4cc121f70faea45389fe7ddc1127ed5cbd8bb
commit message:
"make crypt return an unmatchable hash rather than NULL on failure
unfortunately, a large portion of programs which call crypt are not
prepared for its failure and do not check that the return value is
non-null before using it. thus, always "succeeding" but giving an
unmatchable hash is reportedly a better behavior than failing on
error."

However, we are 2026, and a lot of crypt() usage has improved across
the Linux ecosystem.
There are still some software which need to call crypt() correctly and
Project stormwing members are busy with those (e.g vsftp)
e.g: https://github.com/InfrastructureServices/vsftpd/pull/9

Perhaps we, africans can further contribute to auditing usage of
crypt() across more software ?

Project stormwing members are pushing for musl to review its position:
See email: https://www.openwall.com/lists/musl/2026/11/06/8

Your views are welcome :-)