OpenSSH
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Vulnerability reported by The Register (Security)sshole flaw lets attackers reach root on some musl-based Linux systems via long passwords
- Vulnerability reported by Cyber Security NewsCritical OpenSSH authentication bypass lets attackers reach root on Alpine Linux
Recent news
sshole flaw lets attackers reach root on some musl-based Linux systems via long passwords
Researcher Özgün Kültekin disclosed the sshole flaw, which affects OpenSSH sshd on musl libc Linux systems such as Alpine. It requires sshd without PAM, password authentication enabled, at least one account with an asterisk in its password field, and another account with a valid hash. Passwords of 257 to 1,024 characters can then grant access to accounts that should not accept passwords, including root. OpenSSH 10.6p2 or newer fixes it.
Critical OpenSSH authentication bypass lets attackers reach root on Alpine Linux
A critical authentication bypass, dubbed "sshole", affects OpenSSH on musl-based Linux distributions such as Alpine. An unauthenticated attacker can log in over SSH password authentication as accounts that should not accept passwords, including root. On a default Alpine install, a single connection can grant root access. No CVE identifier has been assigned yet.