OpenSSH 10.6p2 fixes long password bypass on Alpine Linux SSH
Original title: OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux
Long passwords bypass SSH authentication for passwordless accounts on Alpine Linux; OpenSSH 10.6p2 and Alpine updates released.
OpenSSH 10.6p2 blocks a flaw where long passwords 257-1024 bytes allow logins to accounts with no password on Alpine Linux openssh-server. The issue stems from musl C library behavior without PAM. No attacks reported. Affected systems must update packages and restart sshd or set PasswordAuthentication=no.
Unconfirmed: No attacks using the flaw have been reported.
- Flaw allows passwordless account logins via long passwords on Alpine
- OpenSSH rates flaw critical; fixed in 10.6p2
- Affects only Alpine without PAM; not glibc or PAM systems
- Update via apk upgrade -U -a then rc-service sshd restart
- Point releases 3.21.10 and later include fix
- Vendors
- OpenSSH
- Products
- openssh-server
- Organizations
- Alpine Linux
From the original article
5 min read at thehackernews.com
Attackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name, and a password between 257 and 1,024 bytes long. OpenSSH, which rates the flaw critical, released version 10.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.