Open Source Security Mailing List

Discussion of security flaws, concepts, and practices in the Open Source community

List Archives

Latest Posts

UnrealIRCd 6.2.7.1 released & hot-patch (CVE-2026-114713) Bram Matthys (Nov 08)
Last Saturday, 7-Nov-2026, I put out a security release and hot-patch
for UnrealIRCd. The CVE entry CVE-2026-114713 has been published now.

This is an escaping bug in UnrealIRCd's implementation of the IRCv3
"label" message tag. Any user can inject newlines (\n) and other things
into server-to-server traffic. In a text protocol like IRC this means
one can issue arbitrary commands, in this case with server authority.

What is...

CVE-2026-123776: RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process Robert Rothenberg (Nov 07)
========================================================================
CVE-2026-123776                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-123776

  Distribution:  RRD-CGI-Image
      Versions:  through 0.01
      MetaCPAN:  https://metacpan.org/dist/RRD-CGI-Image

RRD::CGI::Image versions through 0.01...

CVE-2026-121265: SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update Robert Rothenberg (Nov 07)
========================================================================
CVE-2026-121265                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-121265

  Distribution:  SQL-Abstract
      Versions:  before 2.000003
      MetaCPAN:  https://metacpan.org/dist/SQL-Abstract
      VCS Repo: ...

Re: "sshole": password authentication bypass: OpenSSH + musl libc theknell (Nov 07)
Following up on my measurements post from last night. The question
of whether those numbers were actually measured has come up since
— privately, mostly — so the full raw log is public now:

https://archive.org/details/knell-sshole-receipts

82,236 lines: the crypt() census output, the end-to-end sshd timing
runs on both rigs (mixed accounts and the all-locked box), every
data file with its timestamp and SHA-256, and the harness sources
that...

Re: "sshole": password authentication bypass: OpenSSH + musl libc Richard Kettlewell (Nov 07)
https://github.com/besser82/libxcrypt/blob/develop/lib/util-make-failure-token.c

Pedantically: the result will be "*" if the buffer is only two bytes
(L37-42). I don't whether any real-life callers do this.

ttfn/rjk

Re: "sshole": password authentication bypass: OpenSSH + musl libc theknell (Nov 06)
Jacob — you asked whether it even entirely works when there
is no salt to borrow. The rigs were still up, so I built
the box. OpenSSH 10.6p2 --without-pam, shadow file with no
valid password in it anywhere: accounts locked as *, !, !!,
*LK*, and a locked yescrypt hash (!$y$...), password auth
still on. 60 interleaved samples per account, auth-request
time only, glibc/libxcrypt and musl both. Harnesses and
raw data available on request.

Nothing...

Re: "sshole": password authentication bypass: OpenSSH + musl libc Jacob Bachmeyer (Nov 06)
Does it even entirely work?  What if there is no salt to borrow?

Thinking about this, I think I see another information leak: does sshd
produce a "fake salt" or fail the authentication quickly, thus leaking
the fact that no accounts on the box have a valid password?

There was a time when a salt could be assumed to exist, but that was
before cloud VM images that have no console and therefore can be
network-login-with-SSH-key...

Re: "sshole": password authentication bypass: OpenSSH + musl libc theknell (Nov 06)
Said I'd figure it out, so here we go. Two things in this thread
stayed stuck at the arguing stage: what crypt() actually hands back
when it fails, in each implementation, and Jeff's timing point. I
measured both, on my own machines — OpenSSH 10.6p2 built
--without-pam, glibc 2.39 / libxcrypt 4.4.36 (Ubuntu 24.04), musl
1.2.5 (Alpine 3.21). Harnesses and raw data available on request.

First, the return values, because this is where...

Re: "sshole": password authentication bypass: OpenSSH + musl libc Matt Johnston (Nov 06)
I view avoiding account existence exposure as more of a
privacy feature than security.
If you iterate all the internet's ipv4 sshds (not hard) for
ones that accept say "pgut001", then you've found someone's
IP. Maybe that's already exposed in other ways, but maybe not.

As purely a security feature I agree the added complexity
isn't worth it.

Cheers,
Matt

Re: "sshole": password authentication bypass: OpenSSH + musl libc Michael Orlitzky (Nov 06)
It was easy to lose in the noise, but musl is not the only one doing
this:

https://github.com/besser82/libxcrypt/blob/develop/configure.ac#L322

Re: "sshole": password authentication bypass: OpenSSH + musl libc Loganaden Velvindron (Nov 06)
I've done some auditing of crypt() usage in the Linux ecosystem.
Most software is now handling NULL from crypt() but there are some issues like
https://github.com/InfrastructureServices/vsftpd/pull/9

I think it's time for musl libc to revisit the idea and return NULL on
failure and see
which software is still breaking.

The commit in musl dates back to 2012. A lot has happened since 2012:...

CVE-2026-118196: Apache Allura: OAuth1 rebinding Dave Brondsema (Nov 06)
Severity: critical

Affected versions:

- Apache Allura through 1.22.0

Description:

OAuth 1 rebinding vulnerability in Apache Allura.

This issue affects Apache Allura: through 1.22.0.

Users are recommended to upgrade to version 1.22.1, which fixes the issue.

Credit:

hataehoon (reporter)

References:

https://allura.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-118196

[oss-security][CVE-2026-119170] Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10 Alan Coopersmith (Nov 06)
-------- Forwarded Message --------
Subject: [Security-announce][CVE-2026-119170] Regression in FIPS enforcement of
hash algorithms affecting only Python 3.14.10
Date: Fri, 6 Nov 2026 14:45:25 +0000
From: Seth Larson <seth () python org>
Reply-To: security-sig () python org
To: security-announce () python org

There is a HIGH severity vulnerability affecting CPython.

There was a regression in how FIPS algorithms were...

InfiniteWP Client: the NOSSL signing key has 31 bits of secret — recovered live in 291.9 seconds theknell (Nov 06)
InfiniteWP Client 1.13.10 — a WordPress management plugin on roughly
200,000 installs — speaks to its management panel through two
authentication branches. The strong branch verifies an RSA
signature. The other, NOSSL, is selected by the enrolling panel
setting one request parameter, on hosts fully capable of RSA. Once
its key is stored, the selection is permanent and the RSA branch is
unreachable.

The stored key is generated as:...

CVE-2026-123779: Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes Robert Lazarski (Nov 06)
Severity: low

Affected versions:

- Apache Axis2/Java before 2.0.2
- Apache Axis2/Java before 2.0.2

Description:

Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was
enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd
file routes, the named-WSDL ?wsdl=NAME route of the standalone HTTP server, the...

More Lists

Dozens of other network security lists are archived at SecLists.Org.