Long passwords bypass SSH on musl-based Alpine and OpenWrt
Original title: Any long password will do: SSH flaw lets hackers into Alpine systems, routers and more
Researcher Özgün Kültekin dubbed the decade-old bug sshole; emergency updates exist, with no attacks confirmed here.
A flaw in OpenSSH built on the musl library accepts any password between 257 and 1024 characters, according to reporting on researcher Özgün Kültekin. Alpine Linux, OpenWrt and other musl-based systems, including containers, routers and IoT devices, are described as affected. An attacker needs only to reach the SSH port. Emergency updates are available; the report names no CVE or fixed versions.
Unconfirmed: The report does not confirm real-world exploitation or name fixed versions.
- The researcher calls the flaw sshole.
- Alpine's Docker image is cited at over 30 million weekly downloads.
- Passwords from 257 to 1024 characters are said to succeed.
- The flaw is described as about a decade old.
Impact: SSH login using any 257- to 1024-character password
| Product | Affected |
|---|---|
| OpenSSH | on the musl library |
| Alpine Linux | — |
| OpenWrt | — |
- 1.Update OpenSSH immediately on Alpine, OpenWrt and other musl-based systems.
- Vendors
- OpenSSHAlpine LinuxOpenWrt
- Products
- musl
From the original article
2 min read at databreaches.netErnestas Naprys reports: A massive decade-old flaw affects Alpine and other distributions that run OpenSSH on the musl library. Containers, routers, IoT devices, and other applications are critically vulnerable. Emergency updates are available.
By Dissent · databreaches.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.