*sshole, or when are we finally going to get rid of C? · sunshowers
- Yet another day, yet another vulnerability in core C code.
- This one happened due to two different conditions using the same sentinel value:On Unix, a password hash of "*" has meant a locked account since the very early days.
- Since 2012, musl libc’s crypt function has returned the string "*" for a password that’s too long for it to hash.
Unverified
- Yet another day, yet another vulnerability in core C code.
- This one happened due to two different conditions using the same sentinel value:On Unix, a password hash of "*" has meant a locked account since the very early days.
- Since 2012, musl libc’s crypt function has returned the string "*" for a password that’s too long for it to hash.
Sources: Sunshowers