Critical OpenSSH flaw lets attackers bypass password login on some Alpine Linux servers
CRITICAL · VULNERABILITYredteam/daily · 1 source
- Severity
- Critical
- Sources
- 1
What happened
A critical OpenSSH password authentication bypass affects Alpine Linux systems using musl libc with PAM disabled, letting a remote attacker log in with one connection if the account has a '' password field and another local account has a $5$ or $6$ hash. Portable OpenSSH 10.6p2 adds an upstream workaround, and Alpine has released fixed packages for its supported branches.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Install Alpine's fixed openssh packages (3.21.10, 3.22.8, 3.23.8 or 3.24.4 branches) and restart sshd.
- If patching must wait, set PasswordAuthentication no, confirm key-based access works, and keep an existing session open while restarting sshd.
- Review logs for 'Accepted password' entries involving passwordless accounts, and check for unexpected doas activity and new authorised keys.
- Treat affected machines as compromised if unauthorised access cannot be ruled out.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News