OpenSSH-musl flaw lets oversized passwords bypass blocked logins
Original title: New OpenSSH Vulnerability
The decade-old *sshole bug affects certain Alpine and other musl-based accounts set to reject password authentication.
A newly disclosed flaw involving OpenSSH and musl, dubbed *sshole, has been in the code for a decade. Attackers can log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication by entering a password longer than 256 bytes. The post links to technical details but does not name a CVE, a fixed version, or confirmed attacks.
Unconfirmed: The post does not identify a CVE, affected versions, or a fix.
- Passwords longer than 256 bytes are enough to trigger the login bypass.
- Only accounts configured to block password authentication are described as affected.
- The post does not name a CVE or a patched OpenSSH release.
Impact: Login to accounts configured to block password authentication
| Product | Affected |
|---|---|
| OpenSSH | — |
| musl | — |
| Alpine Linux | — |
- Products
- Alpine Linux
From the original article
1 min read at schneier.comIt’s a bad one, and it’s been in the code for a decade: A newly disclosed flaw involving OpenSSH and musl, dubbed “*sshole,” allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication simply by entering an oversized password. “Oversized” means longer than 256 bytes. Details.
By Bruce Schneier · schneier.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.