Critical OpenSSH flaw lets attackers bypass password login on some Alpine Linux servers
CRITICAL · VULNERABILITYredteam/daily · 1 source
- Severity
- Critical
- Sources
- 1
What happened
A serious flaw in the SSH remote login software can let an attacker get into some Alpine Linux servers without knowing the password. It only affects servers set up in a specific way, and fixed versions are now available.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Install Alpine's fixed openssh packages (3.21.10, 3.22.8, 3.23.8 or 3.24.4 branches) and restart sshd.
- If patching must wait, set PasswordAuthentication no, confirm key-based access works, and keep an existing session open while restarting sshd.
- Review logs for 'Accepted password' entries involving passwordless accounts, and check for unexpected doas activity and new authorised keys.
- Treat affected machines as compromised if unauthorised access cannot be ruled out.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News