Musl – OpenSSH password auth bypass analysis

Rich Felker, musl's maintainer, published a root-cause analysis of an OpenSSH password bypass affecting versions before 10.6p2 on musl when UsePAM=no and PasswordAuthentication=yes. OpenSSH uses another user's hash as salt to mask timing for locked accounts. An overlong password makes SHA256/SHA512 crypt fail, returning musl's "*" failure token, which matches a locked "*" entry. OpenSSH now rejects short hashes outright; musl may switch tokens. The claims are the maintainer's own and not independently verified.