ASA-2019-00652 – OpenBSD: libc’s authentication layer performed insufficient username validation

libc in OpenBSD allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiusd. This is related to gen/auth_subr.c and gen/authenticate.c in libc (and login/login.c and xenocara/app/xenodm/greeter/verify.c).

ASA-2019-00650 – OpenBSD: Local privilege escalation via su

A local attacker can exploit su's -L option ("Loop until a correct username and password combination is entered") to log in as themselves but with another user's login class (with the exception of root's login class if the attacker is not in the group "wheel"), because the class variable is set once and never reset.

ASA-2019-00664 – Git: Git mistakes some paths for relative paths allowing writing outside of the worktree while cloning

While the only permitted drive letters for physical drives on Windows are letters of the US-English alphabet, this restriction does not apply to virtual drives assigned via subst : . Git mistook such paths for relative paths, allowing writing outside of the worktree while cloning.