Decade-old flaw lets attackers SSH into some Alpine Linux devices without a password
VULNERABILITYOpenSSHredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
A decade-old flaw in the OpenSSH and musl interaction allows passwordless SSH login on some Alpine Linux configurations, and possibly other distributions using the same setup. Exploitation needs OpenSSH linked against musl with PAM not in use, at least one account with a SHA256 or SHA512 password hash, and a target account set to "" in /etc/shadow. The article gives no CVE ID or fixed version. Defenders should check for musl-based OpenSSH without PAM and review /etc/shadow for passwordless accounts, and should watch for vendor advisories.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Check whether any systems run Alpine Linux or other musl-based distributions with OpenSSH and without PAM.
- Review /etc/shadow for accounts with "" in the password field and restrict SSH access to them.
- Watch for vendor advisories and apply patches once a fix is published.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Ars Technica (Security)
Who and what is in it
Products