Comment by dabinat
2 days ago
This is why I don’t fully buy the argument that software that’s been around for a long time is more secure and reliable because it’s been battle-tested. There’s been a lot of time for cruft to accumulate until no-one can ever fix it because everyone is expecting it to function in the broken manner it’s always functioned. And some of the more obscure configuration options get a lot less scrutiny.
Musl, which is vulnerable, is much younger and less battle tested than glibc, which is not vulnerable though
This is not an obscure configuration option. Your password file almost certainly has at least one account with "*" as the password hash.
Integration of different software is the stage most likely to introduce uncaught bugs. That is what happened here: musl intentionally broke the documented API of a function used by OpenSSH. Then Alpine integrated this incorrect implementation with OpenSSH.