News for hackers. Stuff that matters.

A comment on Alpine Linux Security advisory: OpenSSH-server password authentication bypass. Parent comment

Re:Alpine Linux Security advisory: OpenSSH-server password a... by mort96 on Thursday November 05, 2026 @01:27PM (#50382569)
The spec is pretty unambiguous here: https://pubs.opengroup.org/onlinepubs/9799919799/functions/c...

> Upon successful completion, crypt() shall return a pointer to the hashed password [...]. Otherwise, it shall return a null pointer and set errno to indicate the error.

[ Parent | on HN ]
Re:Alpine Linux Security advisory: OpenSSH-server password a... by shakna on Thursday November 05, 2026 @03:35PM (#50384140)
You need to add that the spec _also_ only defines a singular error state, that isn't applicable here.

> The crypt() function shall fail if:

> [ENOSYS]

> The functionality is not supported on this implementation.

[ Parent | on HN ]
Re:Alpine Linux Security advisory: OpenSSH-server password a... by mort96 on Thursday November 05, 2026 @07:25PM (#50386551)
I don't think those error sections are generally meant to be exhaustive?
[ Parent | on HN ]