Alpine OpenSSH bypass lets attackers log in without the password
Original title: Alpine Linux Security advisory: OpenSSH-server password authentication bypass
A reachable sshd built without PAM accepts one 257-to-1024-byte password for accounts whose shadow field is *.
Alpine Linux warned that openssh-server built without PAM, or openssh-server-pam with UsePAM no, can accept a password login without the real password. An attacker needs a reachable SSH port, PasswordAuthentication yes, an account whose password field is *, and another local account with a $5$ or $6$ hash. Fixed packages are available back to Alpine 3.16, but the running sshd must be restarted. No CVE had been assigned.
Unconfirmed: No CVE was assigned at publication, and the advisory does not say the bug is exploited.
- Affected releases are Alpine 3.21 through 3.24, edge, and 3.16 to 3.20.
- Fixed versions include edge 10.6_p2-r0 and Alpine 3.24 openssh 10.3_p1-r2.
- openssh-server-pam with UsePAM yes is not affected.
- tiny-cloud images become rootable via alpine and doas once a $6$ hash exists.
- Check logs for Accepted password on accounts that have no password.
Impact: SSH login without the password, including root via doas
| Product | Affected | Fixed in |
|---|---|---|
| Alpine Linux openssh-server | 3.16 through 3.24 and edge, without PAM or with UsePAM no | edge 10.6_p2-r0; 3.24 10.3_p1-r2; 3.23 10.2_p1-r1; 3.22 10.0_p1-r11; 3.21 9.9_p2-r1; 3.20 9.7_p1-r6; 3.19 9.6_p1-r3; 3.18 9.3_p2-r4; 3.17 9.1_p1-r7; 3.16 9.0_p1-r6 |
- 1.Upgrade openssh and restart sshd; the package upgrade does not restart the daemon.
- 2.If you cannot update, set PasswordAuthentication no and restart sshd.
- 3.Review sshd logs, doas use, new users, files, and authorized keys.
- Vendors
- Alpine Linux
- Products
- OpenSSHopenssh-server
From the original article
5 min read at alpinelinux.orgIf you run sshd on Alpine Linux, update openssh now and restart sshd . Upgrading the package alone does not replace the running daemon. If you cannot update yet, at least disable password logins: set
By pantalaimon · alpinelinux.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.