Decade-old flaw lets attackers SSH into some Alpine Linux devices without a password
VULNERABILITYOpenSSHredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
A flaw that has existed for about ten years can let attackers log into some Linux devices without a password. It affects some Alpine Linux setups and possibly other Linux systems with the same configuration. The attack only works when specific settings are in place.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Check whether any systems run Alpine Linux or other musl-based distributions with OpenSSH and without PAM.
- Review /etc/shadow for accounts with "" in the password field and restrict SSH access to them.
- Watch for vendor advisories and apply patches once a fix is published.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Ars Technica (Security)
Who and what is in it
Products