OpenSSH musl bypass and Perl module CVEs

OpenSSH issued a fix for a password authentication bypass on musl libc systems without PAM, while two Perl CPAN modules received advisories for SQL injection and process blocking. Activity focused on authentication edge cases and niche library input handling.

OpenSSH password bypass with musl libc

OpenSSH 10.6p2 addresses a password authentication bypass on systems using musl libc without PAM. The issue arises because crypt(3) can return a literal asterisk, which the authentication path mishandles. Operators running OpenSSH against musl without PAM should update, as the flaw allows authentication to succeed incorrectly.

SQL injection in SQL::Abstract

SQL::Abstract versions before 2.000003 for Perl allow SQL injection when an arrayref is supplied as a column value in insert or update operations. The flaw is tracked as CVE-2026-121265. Applications that build queries through this module and accept untrusted structure for column values need the updated release.

Unvalidated tz parameter in RRD::CGI::Image

RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containing tz directly to tzset(). Supplying a FIFO or device path can block the CGI process, as reported under CVE-2026-123776. The module is narrow in scope, yet any exposed CGI using it should validate or reject such parameters.