Hi Walter, > Date: 2026-11-09 08:59:19+0000 > From: Walter Harms > > Hello list, > in case someone missed it: musl crypt() had an documented but > unexpected behavier that caused a lot of trouble. See: > SSHHole.com CVE-2026-123158 Indeed, I also wondered if we should change something in the documentation after it happened. Unfortunately, the bug has been treated with some secrecy in the first days (reasonable), so I couldn't really understand what went wrong. I've CCed Rich and also musl and glibc, since they probably want to comment. I've also CCd shadow-utils. > Normaly i would step over it but in this special case ... it would > like to start a discussion if we should mention that in a note to > crypt(). Thanks! > Perhaps recommending an additional check for '*' ? I am not sure but > this is a very special case ... Rich, now that some time has passed and I guess everyone has a patched SSH, would you mind clarifying what happened, and what should be documented about it? Have a lovely day! Alex > CU --