Critical OpenSSH flaw lets attackers bypass password login on some Alpine Linux servers
- Severity
- Critical
- Sources
- 1
What happened
Critical password authentication bypass in OpenSSH on Alpine Linux, where musl crypt() returns '' for overlong passwords and sshd accepts it against accounts with '' in the password field. Requires PasswordAuthentication yes, a non-PAM build (openssh-server, or openssh-server-pam with UsePAM no), and a $5$/$6$ hash on another account; affects official tiny-cloud images 3.18.11 to 3.24.3 where alpine has passwordless doas. No CVE assigned at publication. Patch to Alpine 3.21.10, 3.22.8, 3.23.8 or 3.24.4 (or Portable OpenSSH 10.6p2 workaround) and restart sshd. Where patching is delayed, set PasswordAuthentication no and check logs for 'Accepted password' events on passwordless accounts, unexpected doas use and new authorizedkeys; treat hosts as compromised if unauthorised access cannot be excluded.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Install Alpine's fixed openssh packages (3.21.10, 3.22.8, 3.23.8 or 3.24.4 branches) and restart sshd.
- If patching must wait, set PasswordAuthentication no, confirm key-based access works, and keep an existing session open while restarting sshd.
- Review logs for 'Accepted password' entries involving passwordless accounts, and check for unexpected doas activity and new authorised keys.
- Treat affected machines as compromised if unauthorised access cannot be ruled out.
Written by AI from the sources, checked against them