Critical OpenSSH flaw lets attackers log into password-disabled accounts on musl-based Linux
CRITICAL · VULNERABILITYOpenSSHredteam/daily · 1 source
- Severity
- Critical
- Highest CVSS
- 8.1
- Exploited
- Not known
- Sources
- 1
What happened
A serious flaw in OpenSSH, a tool many servers use for remote logins, lets attackers get into some accounts that should never accept a password. It affects certain Linux systems, including the lightweight Alpine Linux that is common in cloud containers. Fixes have been released, and administrators are advised to update or turn off password logins.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Update OpenSSH to version 10.6p2 or install the fixed Alpine openssh package.
- If you cannot update, disable password-based authentication in the OpenSSH configuration and set up key-based authentication.
- Check logs for 'Accepted password' entries on accounts that have no password, such as root, key-only users or the default alpine user.
- Review doas usage and recently created users, and treat any server where a login cannot be ruled out as compromised.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
CSO Online