musl libc
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Vulnerability reported by SecurityWeekOpenSSH rushes patches for 'SSHole' authentication bypass
- Vulnerability reported by The Register (Security)sshole flaw lets attackers reach root on some musl-based Linux systems via long passwords
Recent news
OpenSSH rushes patches for 'SSHole' authentication bypass
OpenSSH is releasing patches for an authentication bypass dubbed 'SSHole'. On Linux distributions that use musl libc without PAM, some accounts accept any password between 257 and 1024 characters.
sshole flaw lets attackers reach root on some musl-based Linux systems via long passwords
Researcher Özgün Kültekin disclosed the sshole flaw, which affects OpenSSH sshd on musl libc Linux systems such as Alpine. It requires sshd without PAM, password authentication enabled, at least one account with an asterisk in its password field, and another account with a valid hash. Passwords of 257 to 1,024 characters can then grant access to accounts that should not accept passwords, including root. OpenSSH 10.6p2 or newer fixes it.