Critical · 1 source · latest 6h

OpenSSH emergency fix for flaw letting long passwords bypass SSH login on Alpine Linux

CRITICAL · VULNERABILITYOpenSSHredteam/daily · 1 source

Severity: Critical
Sources: 1

What happened

Some Alpine Linux servers running the standard openssh-server package can be breached by an attacker with network access, an account name and a password between 257 and 1,024 bytes long. The flaw lets them log in to accounts with no password, such as SSH key-only accounts. OpenSSH rates it critical and released version 10.6p2 to block it, and Alpine has published fixed packages.

For IT people · Written by AI from 1 source · Wrong?

What to do

Update OpenSSH to version 10.6p2 or later.
Install the fixed openssh-server packages that Alpine Linux has published.
Check whether any Alpine Linux servers run openssh-server and have accounts without passwords.

Written by AI from the sources, checked against them

Read the full story at the source