André Baptista(@0xacb):Just reproduced sshole (CVE-2026-123158), beautifully simple bug by @kultekin Needs password auth on and no PAM, but you can ssh as root into an unpatched Alpine box with any 257+ byte password. musl crypt() returns "*" for any password over 256 bytes. a locked account's shadow field is also "*". sshd compares them and they match. fix: openssh 10.6p2

André Baptista

@0xacb

Hacker grinding for L1gh7 and Fr33dφm, straight outta the cosmic realm. Co-founder @ethiack

参加 April 2013

883 フォロー中 20.3K ファン

André Baptista@0xacb

2026.11.05 16:58

Just reproduced sshole (CVE-2026-123158), beautifully simple bug by @kultekin Needs password auth on and no PAM, but you can ssh as root into an unpatched Alpine box with any 257+ byte password. musl crypt() returns "*" for any password over 256 bytes. a locked account's shadow field is also "*". sshd compares them and they match. fix: openssh 10.6p2